PCIP Incident Response 3

Question 1

A QSA discovers during an investigation that an organization's IDS alerts were ignored for three weeks before a breach was detected. This failure represents a gap in which incident response phase?

Accepted Answer

Detection and analysis

Answer

Failing to act on IDS alerts is a detection and analysis failure, as the organization did not properly monitor and triage security events.

Question 2

When engaging a PFI (PCI Forensic Investigator), who is responsible for initiating the engagement after a confirmed cardholder data breach?

Accepted Answer

The breached merchant or service provider

Answer

The breached entity (merchant or service provider) is responsible for immediately engaging a PFI upon confirmation of a cardholder data compromise.

Question 3

Which element is NOT typically included in a PCI DSS incident response plan?

Accepted Answer

Quarterly employee performance reviews

Answer

Performance reviews are an HR function unrelated to incident response; IRP elements focus on response roles, communication, evidence handling, and recovery procedures.

Question 4

An attacker compromised an e-commerce site's payment page by injecting malicious JavaScript. This attack vector is best described as:

Accepted Answer

E-skimming (Magecart-style attack)

Answer

E-skimming or Magecart-style attacks involve injecting malicious JavaScript into payment pages to capture cardholder data in real time.

Question 5

After eradicating malware from a compromised system in the CDE, what must be verified before returning the system to production?

Accepted Answer

The system is clean, patched, and all vulnerabilities are remediated

Answer

Before restoring a system, organizations must verify it is free of malware, fully patched, and all exploited vulnerabilities are remediated to prevent reinfection.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Incident Response 3