PCIP Network Security 4 — Questions and Answers
Question 1: What is the significance of a 'flat network' in PCI DSS assessments?
- It means all systems are equally protected with strong controls
- It means there is no segmentation, placing all systems in scope for PCI DSS (Correct answer)
- It refers to a network using only Layer 2 switches
- It indicates a fully compliant network topology
Correct answer: It means there is no segmentation, placing all systems in scope for PCI DSS
A flat network with no segmentation means every system on the network is technically in scope for PCI DSS, dramatically increasing compliance burden.
Question 2: Which attack involves an adversary positioning themselves between two communicating parties to intercept or modify traffic?
- Replay attack
- Man-in-the-middle (MitM) attack (Correct answer)
- Denial-of-service attack
- SQL injection attack
Correct answer: Man-in-the-middle (MitM) attack
A man-in-the-middle attack allows an attacker to intercept, read, or alter communications between two parties without their knowledge.
Question 3: Under PCI DSS, what is required for wireless networks that are connected to the CDE or that transmit cardholder data?
- WPA2 or WPA3 with AES encryption and changed vendor defaults (Correct answer)
- WEP encryption with a complex passphrase
- Any encryption protocol approved by the acquiring bank
- No specific wireless protocol is mandated
Correct answer: WPA2 or WPA3 with AES encryption and changed vendor defaults
PCI DSS requires strong wireless security (WPA2/WPA3 with AES) and changing all vendor default settings for any wireless network in or connected to the CDE.
Question 4: What is 'port scanning' used for in the context of PCI DSS network security assessments?
- To measure network bandwidth utilization
- To identify open ports and services that may represent attack vectors (Correct answer)
- To test wireless signal strength
- To verify firewall log integrity
Correct answer: To identify open ports and services that may represent attack vectors
Port scanning discovers open TCP/UDP ports and associated services, helping identify unnecessary or unauthorized network entry points that should be closed.
Question 5: Which type of VPN is typically used to provide secure remote access for administrators managing CDE systems?
- Split-tunnel VPN without authentication
- SSL/TLS VPN or IPsec VPN with multi-factor authentication (Correct answer)
- PPTP VPN with username and password only
- L2TP VPN with default shared secrets
Correct answer: SSL/TLS VPN or IPsec VPN with multi-factor authentication
Secure remote access to CDE systems requires strong VPN protocols (SSL/TLS or IPsec) combined with MFA to prevent unauthorized access.
Question 6: What is 'egress filtering' and why is it important in a PCI DSS environment?
- Filtering traffic entering the network to block attacks
- Filtering outbound traffic to prevent unauthorized data exfiltration (Correct answer)
- Filtering internal traffic between VLANs
- Filtering encrypted traffic for content inspection
Correct answer: Filtering outbound traffic to prevent unauthorized data exfiltration
Egress filtering controls outbound traffic from the CDE, preventing malware or attackers from exfiltrating cardholder data to external destinations.
Question 7: A QSA finds that a company uses the same VLAN for cardholder data systems and general office workstations. What is the primary concern?
- Performance degradation from mixed traffic types
- Insufficient network segmentation placing workstations in PCI DSS scope (Correct answer)
- VLAN configuration complexity increases audit difficulty
- Office workstations cannot comply with password policies
Correct answer: Insufficient network segmentation placing workstations in PCI DSS scope
Sharing a VLAN between the CDE and general office systems means the workstations are in scope for PCI DSS, significantly expanding compliance requirements.
PCIP Network Security 4
What is the significance of a 'flat network' in PCI DSS assessments?