PCIP Incident Response 3 — Questions and Answers
Question 1: A QSA discovers during an investigation that an organization's IDS alerts were ignored for three weeks before a breach was detected. This failure represents a gap in which incident response phase?
- Containment
- Eradication
- Detection and analysis (Correct answer)
- Post-incident review
Correct answer: Detection and analysis
Failing to act on IDS alerts is a detection and analysis failure, as the organization did not properly monitor and triage security events.
Question 2: When engaging a PFI (PCI Forensic Investigator), who is responsible for initiating the engagement after a confirmed cardholder data breach?
- The breached merchant or service provider (Correct answer)
- The card-issuing bank
- The card brands directly
- The federal government
Correct answer: The breached merchant or service provider
The breached entity (merchant or service provider) is responsible for immediately engaging a PFI upon confirmation of a cardholder data compromise.
Question 3: Which element is NOT typically included in a PCI DSS incident response plan?
- Roles and responsibilities of response team members
- Communication procedures for notifying stakeholders
- Quarterly employee performance reviews (Correct answer)
- Procedures for preserving evidence
Correct answer: Quarterly employee performance reviews
Performance reviews are an HR function unrelated to incident response; IRP elements focus on response roles, communication, evidence handling, and recovery procedures.
Question 4: An attacker compromised an e-commerce site's payment page by injecting malicious JavaScript. This attack vector is best described as:
- SQL injection
- E-skimming (Magecart-style attack) (Correct answer)
- Phishing
- Brute-force attack
Correct answer: E-skimming (Magecart-style attack)
E-skimming or Magecart-style attacks involve injecting malicious JavaScript into payment pages to capture cardholder data in real time.
Question 5: After eradicating malware from a compromised system in the CDE, what must be verified before returning the system to production?
- The system has the latest marketing software installed
- The system is clean, patched, and all vulnerabilities are remediated (Correct answer)
- The system's performance benchmarks are restored to baseline
- All employee accounts on the system have been reset to default passwords
Correct answer: The system is clean, patched, and all vulnerabilities are remediated
Before restoring a system, organizations must verify it is free of malware, fully patched, and all exploited vulnerabilities are remediated to prevent reinfection.
Question 6: Which of the following best describes the role of a SIEM during incident response for a PCI-regulated organization?
- Encrypts cardholder data at rest
- Aggregates and correlates security event logs for threat detection (Correct answer)
- Replaces the need for a firewall in the CDE
- Manages vulnerability scan scheduling
Correct answer: Aggregates and correlates security event logs for threat detection
A SIEM aggregates logs from across the environment and correlates events to identify and alert on potential security incidents.
Question 7: Under PCI DSS, how long must audit logs be retained, and how much must be immediately available for analysis?
- 6 months total; 1 month immediately available
- 1 year total; 3 months immediately available (Correct answer)
- 2 years total; 6 months immediately available
- 90 days total; 30 days immediately available
Correct answer: 1 year total; 3 months immediately available
PCI DSS requires audit logs to be retained for at least 12 months, with at least the most recent 3 months immediately available for analysis.
PCIP Incident Response 3
A QSA discovers during an investigation that an organization's IDS alerts were ignored for three weeks before a breach was detected.
This failure represents a gap in which incident response phase?