PCIP Encryption Standards 3

Question 1

Which NIST-approved algorithm is commonly used for hashing PANs to create irreversible tokens under PCI DSS?

Accepted Answer

SHA-256

Answer

SHA-256 (part of the SHA-2 family) is NIST-approved and produces a 256-bit digest suitable for irreversible PAN hashing; MD5 and SHA-1 are considered weak.

Question 2

When using point-to-point encryption (P2PE), at what point in the transaction flow is cardholder data first encrypted?

Accepted Answer

At the point of interaction (POI) device

Answer

In P2PE, cardholder data is encrypted immediately at the point of interaction (POI) device—such as a card reader—before it ever enters the merchant's environment.

Question 3

What does 'forward secrecy' (also called perfect forward secrecy, PFS) provide in TLS connections for payment systems?

Accepted Answer

Session keys that cannot be derived even if the server's long-term private key is later compromised

Answer

PFS uses ephemeral key exchange so that compromise of a long-term private key cannot be used to decrypt previously captured session traffic.

Question 4

Under PCI DSS, what is the maximum recommended cryptoperiod for a data-encrypting key (DEK) used to protect stored cardholder data?

Accepted Answer

One year

Answer

PCI DSS and NIST SP 800-57 recommend that data-encrypting keys used for stored data have a cryptoperiod of no more than one year.

Question 5

Which of the following best describes 'envelope encryption' as used in cloud-based cardholder data storage?

Accepted Answer

Encrypting a DEK with a KEK and storing the wrapped DEK alongside the ciphertext

Answer

Envelope encryption wraps the data-encrypting key (DEK) with a key-encrypting key (KEK), storing the wrapped DEK with the ciphertext so only KEK holders can decrypt.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Encryption Standards 3