PCIP Network Security 3 — Questions and Answers
Question 1: Which encryption protocol is mandated for protecting cardholder data transmitted over open, public networks under PCI DSS?
- WEP
- SSL 3.0
- TLS 1.2 or higher (Correct answer)
- PPTP
Correct answer: TLS 1.2 or higher
PCI DSS Requirement 4 requires strong cryptography (TLS 1.2 or higher) for protecting cardholder data over open, public networks; SSL and early TLS are prohibited.
Question 2: What is a 'rogue wireless access point' in the context of PCI DSS network security?
- An access point with outdated firmware
- An unauthorized wireless device connected to the network without approval (Correct answer)
- A wireless AP outside the physical perimeter
- An access point with a weak WEP password
Correct answer: An unauthorized wireless device connected to the network without approval
A rogue access point is an unauthorized wireless device that may allow attackers to bypass network security controls and access the CDE.
Question 3: Under PCI DSS, how frequently must network security control rule sets (e.g., firewall rules) be reviewed?
- Monthly
- Every six months (Correct answer)
- Annually
- Every two years
Correct answer: Every six months
PCI DSS Requirement 1 requires that firewall and router rule sets be reviewed at least every six months to ensure they remain current and necessary.
Question 4: Which concept describes ensuring that data packets entering a network claim to originate from an IP address that is plausibly routable?
- Egress filtering
- Ingress filtering (Correct answer)
- NAT traversal
- Port mirroring
Correct answer: Ingress filtering
Ingress filtering checks that inbound traffic sources have legitimate, routable IP addresses, helping prevent IP spoofing attacks at the network perimeter.
Question 5: What is 'network address translation' (NAT) and how does it benefit PCI DSS environments?
- NAT encrypts traffic between the CDE and the internet
- NAT hides internal IP addresses from external networks, reducing exposure (Correct answer)
- NAT acts as an intrusion prevention system
- NAT replaces the need for VLANs in the CDE
Correct answer: NAT hides internal IP addresses from external networks, reducing exposure
NAT translates private internal IP addresses to a public address, masking the internal network topology from external attackers.
Question 6: A merchant discovers that their point-of-sale terminals communicate with an undocumented IP address. What is the FIRST step to take?
- Block the IP address immediately at the firewall
- Isolate the affected terminals from the network pending investigation (Correct answer)
- Notify the card brands directly
- Perform a full PCI DSS audit
Correct answer: Isolate the affected terminals from the network pending investigation
Isolating affected systems prevents further potential data exfiltration while preserving evidence needed for forensic investigation.
Question 7: Which PCI DSS requirement addresses the need to track and monitor all access to network resources and cardholder data?
- Requirement 3
- Requirement 7
- Requirement 10 (Correct answer)
- Requirement 12
Correct answer: Requirement 10
PCI DSS Requirement 10 covers logging and monitoring all access to network resources and cardholder data to detect and investigate anomalies.
PCIP Network Security 3
Which encryption protocol is mandated for protecting cardholder data transmitted over open, public networks under PCI DSS?