PCIP Cardholder Data Environment

Question 1

Which of the following best defines the Cardholder Data Environment (CDE) in the context of PCI DSS?

Accepted Answer

The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data

Answer

Any system that connects to the internet and processes financial transactions

Answer

Only the servers that store primary account numbers (PANs) in encrypted form

Answer

The network segment that hosts the organization's payment gateway exclusively

Question 2

Which of the following data elements is considered cardholder data under PCI DSS?

Accepted Answer

The Primary Account Number (PAN)

Answer

The full CVV2/CVC2 code stored post-authorization

Answer

The full contents of the magnetic stripe stored after transaction approval

Answer

The PIN verification value (PVV) stored in a database

Question 3

A retailer's point-of-sale terminals transmit cardholder data to a back-office server that then forwards it to an acquirer. Which systems are considered part of the CDE?

Accepted Answer

The POS terminals, back-office server, and all systems that could impact their security

Answer

Only the back-office server, since it is the central processing point

Answer

Only the POS terminals and the acquirer's systems

Answer

The POS terminals and the back-office server, but not the acquirer's systems

Question 4

Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD)?

Accepted Answer

Full track data from the magnetic stripe

Answer

Cardholder name

Answer

Primary Account Number (PAN)

Answer

Expiration date

Question 5

What is the primary purpose of network segmentation when applied to the CDE?

Accepted Answer

To reduce the scope of PCI DSS compliance by isolating cardholder data systems

Answer

To eliminate the need for firewalls within the payment environment

Answer

To improve network performance by reducing broadcast traffic

Answer

To enable the organization to avoid annual PCI DSS assessments

Question 6

Which statement about storing Sensitive Authentication Data (SAD) post-authorization is correct under PCI DSS?

Accepted Answer

SAD must never be stored after the authorization process is complete, regardless of encryption

Answer

SAD may be stored post-authorization only if it is encrypted with AES-256

Answer

SAD may be stored post-authorization if a documented business justification exists

Answer

SAD may be stored by issuers but not by merchants or acquirers

Question 7

A company uses a third-party payment processor that handles all cardholder data on its behalf, and the company never touches card data directly. How does this affect the company's PCI DSS scope?

Accepted Answer

The company's scope is reduced but it still has PCI DSS obligations related to how it connects to the processor

Answer

The company is entirely exempt from PCI DSS requirements

Answer

The company must still store a full copy of cardholder data for audit purposes

Answer

Only the third-party processor must comply with PCI DSS, not the company