PCIP Encryption Standards 2

Question 1

Which key length is the minimum recommended by PCI DSS for RSA asymmetric encryption used to protect cardholder data?

Accepted Answer

2048-bit

Answer

PCI DSS requires a minimum RSA key length of 2048 bits for asymmetric encryption protecting cardholder data.

Question 2

In the context of PCI DSS, what does the term 'key-encrypting key' (KEK) refer to?

Accepted Answer

A key used to encrypt other cryptographic keys

Answer

A key-encrypting key (KEK) is used solely to encrypt or wrap other cryptographic keys, not cardholder data directly.

Question 3

Which cipher mode makes AES encryption deterministic and therefore unsuitable for encrypting PANs directly under PCI DSS guidance?

Accepted Answer

ECB

Answer

ECB (Electronic Code Book) mode produces identical ciphertext for identical plaintext blocks, making it deterministic and cryptographically weak for PAN protection.

Question 4

What is the primary purpose of an Initialization Vector (IV) in symmetric encryption schemes?

Accepted Answer

To ensure identical plaintexts produce different ciphertexts

Answer

An IV introduces randomness so that encrypting the same plaintext twice with the same key produces different ciphertexts, preventing pattern analysis.

Question 5

Which protocol version is explicitly prohibited by PCI DSS 4.0 for protecting cardholder data in transit?

Accepted Answer

SSL 3.0

Answer

SSL 3.0 (and all SSL versions) are explicitly prohibited by PCI DSS 4.0 due to known vulnerabilities such as POODLE.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Encryption Standards 2