PCIP Encryption Standards 4

Question 1

Which of the following is a valid method to render PAN data unreadable at rest, as accepted by PCI DSS Requirement 3.5?

Accepted Answer

Strong one-way hashing of the full PAN

Answer

PCI DSS Requirement 3.5 accepts strong one-way hashing (using keyed hashes or approved algorithms) as a method to render PANs unreadable at rest.

Question 2

What is 'key splitting' (also called secret sharing) in the context of PCI DSS key custodianship?

Accepted Answer

Dividing a key into multiple components so no single custodian holds the complete key

Answer

Key splitting divides a cryptographic key into two or more components distributed to different custodians, ensuring no single person can reconstruct the full key alone.

Question 3

Which Elliptic Curve Cryptography (ECC) curve is most commonly recommended by NIST for use in payment security at equivalent-to-RSA-2048 security strength?

Accepted Answer

P-256

Answer

NIST P-256 (secp256r1) provides roughly equivalent security to RSA-2048 and is the most commonly specified curve in payment and TLS contexts.

Question 4

What does a Hardware Security Module (HSM) primarily protect in a payment encryption environment?

Accepted Answer

Cryptographic keys, performing key operations inside tamper-resistant hardware

Answer

An HSM is a tamper-resistant hardware device that securely stores cryptographic keys and performs key operations (encryption, signing) without exposing key material to the host system.

Question 5

Under PCI DSS, which of the following is a requirement for cryptographic key custodians?

Accepted Answer

They must sign a form acknowledging their key custodian responsibilities

Answer

PCI DSS requires that key custodians formally acknowledge (typically by signing a form) their understanding of and responsibility for the key custodian role.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Encryption Standards 4