PCIP Network Security 2

Question 1

Which PCI DSS requirement mandates the use of a firewall configuration to protect cardholder data?

Accepted Answer

Requirement 1

Answer

PCI DSS Requirement 1 specifically addresses installing and maintaining network security controls, including firewall configurations.

Question 2

What is the primary purpose of network segmentation in a PCI DSS environment?

Accepted Answer

To reduce the scope of the cardholder data environment

Answer

Network segmentation isolates the cardholder data environment (CDE) from other networks, reducing the number of systems subject to PCI DSS controls.

Question 3

Which type of attack does a Web Application Firewall (WAF) primarily protect against in a cardholder data environment?

Accepted Answer

SQL injection and cross-site scripting

Answer

WAFs are designed to detect and block application-layer attacks like SQL injection and XSS that target web-facing payment applications.

Question 4

Under PCI DSS, what must be done with all unnecessary services, protocols, and ports on systems in the CDE?

Accepted Answer

They must be disabled or removed

Answer

PCI DSS Requirement 2 requires that all unnecessary services, protocols, daemons, and ports be disabled or removed to reduce the attack surface.

Question 5

What is the role of an Intrusion Detection System (IDS) versus an Intrusion Prevention System (IPS) in PCI DSS environments?

Accepted Answer

IDS only alerts on threats; IPS can block threats automatically

Answer

An IDS passively monitors and alerts on suspicious activity, while an IPS actively blocks or drops malicious traffic in real time.

(PCIP) Payment Card Industry Professional Practice Test