PCIP Incident Response 2

Question 1

According to PCI DSS, within how many hours must a payment card brand be notified after confirming a security incident involving cardholder data?

Accepted Answer

24 hours

Answer

PCI DSS requires entities to notify their acquirer and applicable payment brands within 24 hours of confirming a cardholder data incident.

Question 2

Which type of forensic investigation approach involves capturing and analyzing a full bit-for-bit image of a compromised system's storage?

Accepted Answer

Disk imaging

Answer

Disk imaging creates an exact bit-for-bit copy of storage media, preserving all data including deleted files for forensic analysis.

Question 3

During a PCI DSS incident investigation, which log source is most critical for tracing unauthorized access to the cardholder data environment?

Accepted Answer

Authentication and access logs

Answer

Authentication and access logs reveal who accessed the cardholder data environment and when, making them essential for tracing unauthorized access.

Question 4

What is the primary purpose of a 'lessons learned' session conducted after resolving a payment card security incident?

Accepted Answer

To identify improvements to prevent recurrence

Answer

Lessons learned sessions focus on identifying control gaps and process improvements to strengthen defenses and prevent similar incidents.

Question 5

A merchant discovers malware on a POS terminal that was exfiltrating track data. Which containment action should be taken FIRST?

Accepted Answer

Isolate the affected POS terminal from the network

Answer

Network isolation of the affected terminal stops ongoing data exfiltration before any other remediation steps are taken.

(PCIP) Payment Card Industry Professional Practice Test