PCIP Incident Response 4

Question 1

Which of the following is a key deliverable from a PFI (PCI Forensic Investigator) engagement?

Accepted Answer

A forensic investigation report documenting findings and scope of compromise

Answer

The PFI's primary deliverable is a forensic investigation report that documents the attack timeline, scope of compromise, and evidence gathered.

Question 2

A hotel discovers that its property management system was exfiltrating PANs to an external server for the past two months. What is the estimated minimum number of cards that must be assessed for potential compromise?

Accepted Answer

All cards processed since the first day the malware was active

Answer

All payment cards processed during the entire window of compromise must be considered potentially at risk, starting from when the malware first became active.

Question 3

What is 'dwell time' in the context of a payment card breach investigation?

Accepted Answer

The period between initial compromise and detection of the breach

Answer

Dwell time refers to the period an attacker remains undetected within the environment, from initial compromise through detection.

Question 4

Which containment strategy segments a compromised system from the rest of the network while keeping it running for forensic analysis?

Accepted Answer

Network isolation with monitoring

Answer

Network isolation with continued monitoring contains the threat while preserving the system's volatile data (memory, active connections) for forensic examination.

Question 5

After a breach, a card brand may place a merchant on a compliance acceleration program. What is the primary goal of this program?

Accepted Answer

To expedite the merchant's return to full PCI DSS compliance

Answer

Compliance acceleration programs are designed to fast-track the breached entity's remediation efforts and restore full PCI DSS compliance as quickly as possible.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Incident Response 4