Risk Management & Data Protection Strategies Flashcards

A service provider processes cardholder data for multiple merchants. Under PCI DSS, what document must the service provider supply to each merchant to clarify shared compliance responsibilities?

Answer: A responsibility matrix (shared responsibility matrix)

PCI DSS requires service providers to maintain a documented responsibility matrix that explicitly states which requirements are managed by the provider and which remain the merchant's responsibility.

Which cryptographic concept ensures that a sender cannot later deny having sent a message, and is often used in digital payment audit trails?

Answer: Non-repudiation

Non-repudiation uses digital signatures or audit logs to prove the origin of a transaction, preventing parties from falsely denying their actions.

A QSA discovers that an organization's anti-malware solution has not been updated for 45 days on several servers in the cardholder data environment. Which PCI DSS requirement is MOST directly violated?

Answer: Requirement 5 – Protect all systems from malicious software

Requirement 5 mandates that anti-malware solutions be kept current, including virus definitions and engine updates, on all in-scope systems.

What is the primary goal of data minimization as a risk reduction strategy in payment card environments?

Answer: Limiting the volume and retention of cardholder data to reduce breach impact

Data minimization reduces the amount and retention period of cardholder data, shrinking the attack surface and limiting the harm if a breach occurs.

An organization's penetration test reveals that an internal system can reach PAN data stores without passing through a network segmentation control. What is the MOST appropriate remediation?

Answer: Implement and enforce network segmentation to isolate the cardholder data environment from other networks

Proper network segmentation (e.g., firewalls, VLANs with access controls) isolates the CDE, preventing out-of-scope systems from reaching cardholder data.

Under PCI DSS, which role is responsible for overseeing the organization's information security program and is typically designated in writing?

Answer: Chief Information Security Officer (CISO) or equivalent executive

PCI DSS Requirement 12.1.3 requires organizations to formally designate a qualified individual (such as a CISO) responsible for managing the information security program.

Which of the following BEST describes the purpose of an Internal Vulnerability Scan required by PCI DSS Requirement 11.3?

Answer: To identify vulnerabilities within the cardholder data environment by scanning internal IP addresses quarterly

PCI DSS requires quarterly internal vulnerability scans of in-scope systems to identify and remediate weaknesses that could be exploited by an insider or a compromised internal host.