PCIP Cardholder Data Environment

Question 1

Which of the following best defines the Cardholder Data Environment (CDE) in the context of PCI DSS?

Accepted Answer

The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data

Answer

The CDE encompasses all people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, as well as systems connected to or that could impact its security.

Question 2

Which of the following data elements is considered cardholder data under PCI DSS?

Accepted Answer

The Primary Account Number (PAN)

Answer

The Primary Account Number (PAN) is cardholder data; the other options describe sensitive authentication data (SAD) that must never be stored post-authorization.

Question 3

A retailer's point-of-sale terminals transmit cardholder data to a back-office server that then forwards it to an acquirer. Which systems are considered part of the CDE?

Accepted Answer

The POS terminals, back-office server, and all systems that could impact their security

Answer

PCI DSS defines the CDE to include all systems that store, process, or transmit cardholder data AND any systems that could impact the security of those systems, so all interconnected components are in scope.

Question 4

Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD)?

Accepted Answer

Full track data from the magnetic stripe

Answer

Full track data (magnetic stripe or equivalent on a chip) is Sensitive Authentication Data and must never be stored after authorization, unlike PANs, names, or expiration dates, which are cardholder data.

Question 5

What is the primary purpose of network segmentation when applied to the CDE?

Accepted Answer

To reduce the scope of PCI DSS compliance by isolating cardholder data systems

Answer

Network segmentation isolates the CDE from other networks, which reduces the number of systems in scope for PCI DSS and can simplify compliance efforts.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Cardholder Data Environment