PCIP Network Security 2 — Questions and Answers
Question 1: Which PCI DSS requirement mandates the use of a firewall configuration to protect cardholder data?
- Requirement 1 (Correct answer)
- Requirement 3
- Requirement 6
- Requirement 10
Correct answer: Requirement 1
PCI DSS Requirement 1 specifically addresses installing and maintaining network security controls, including firewall configurations.
Question 2: What is the primary purpose of network segmentation in a PCI DSS environment?
- To improve network performance
- To reduce the scope of the cardholder data environment (Correct answer)
- To simplify IP address management
- To enable easier patch management
Correct answer: To reduce the scope of the cardholder data environment
Network segmentation isolates the cardholder data environment (CDE) from other networks, reducing the number of systems subject to PCI DSS controls.
Question 3: Which type of attack does a Web Application Firewall (WAF) primarily protect against in a cardholder data environment?
- DDoS volumetric attacks
- SQL injection and cross-site scripting (Correct answer)
- Brute-force SSH attempts
- ARP spoofing attacks
Correct answer: SQL injection and cross-site scripting
WAFs are designed to detect and block application-layer attacks like SQL injection and XSS that target web-facing payment applications.
Question 4: Under PCI DSS, what must be done with all unnecessary services, protocols, and ports on systems in the CDE?
- They must be documented in a risk register
- They must be disabled or removed (Correct answer)
- They must be monitored continuously
- They must be encrypted
Correct answer: They must be disabled or removed
PCI DSS Requirement 2 requires that all unnecessary services, protocols, daemons, and ports be disabled or removed to reduce the attack surface.
Question 5: What is the role of an Intrusion Detection System (IDS) versus an Intrusion Prevention System (IPS) in PCI DSS environments?
- IDS blocks threats automatically; IPS only alerts
- IDS only alerts on threats; IPS can block threats automatically (Correct answer)
- Both perform identical functions
- IDS is required; IPS is optional under PCI DSS
Correct answer: IDS only alerts on threats; IPS can block threats automatically
An IDS passively monitors and alerts on suspicious activity, while an IPS actively blocks or drops malicious traffic in real time.
Question 6: Which protocol is considered insecure for administrative access to network devices in the CDE and should be replaced?
- SSH v2
- Telnet (Correct answer)
- HTTPS
- SNMPv3
Correct answer: Telnet
Telnet transmits data including credentials in cleartext and must be replaced with encrypted alternatives like SSH for secure administrative access.
Question 7: What does a 'DMZ' (demilitarized zone) accomplish in a PCI DSS network architecture?
- It encrypts all inbound payment traffic
- It creates a buffer zone between untrusted external networks and the internal CDE (Correct answer)
- It stores cardholder data in an isolated segment
- It replaces the need for a firewall
Correct answer: It creates a buffer zone between untrusted external networks and the internal CDE
A DMZ sits between the internet and the internal network, hosting public-facing services while preventing direct external access to the CDE.
PCIP Network Security 2
Which PCI DSS requirement mandates the use of a firewall configuration to protect cardholder data?