PCIP Risk Assessment 2

Question 1

During a PCI DSS risk assessment, which threat modeling approach focuses on identifying assets, threats, vulnerabilities, and countermeasures?

Accepted Answer

OCTAVE

Answer

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is an asset-driven threat modeling approach widely used in PCI DSS risk assessments.

Question 2

A risk assessment identifies that a third-party vendor stores cardholder data. Under PCI DSS, what is the PRIMARY responsibility of the assessed entity?

Accepted Answer

Ensure the vendor is PCI DSS compliant and monitor their compliance

Answer

The assessed entity must ensure third-party service providers are PCI DSS compliant and maintain ongoing monitoring of their compliance status.

Question 3

Which PCI DSS requirement mandates that a formal risk assessment be performed at least annually?

Accepted Answer

Requirement 12

Answer

PCI DSS Requirement 12.3 requires that a risk assessment be performed at least annually and upon significant changes to the environment.

Question 4

When assessing residual risk after controls are applied, which formula best represents the calculation?

Accepted Answer

Residual Risk = Inherent Risk − Control Effectiveness

Answer

Residual risk is the remaining risk after subtracting the risk reduction achieved by implemented controls from the inherent risk.

Question 5

A PCIP professional is reviewing a risk assessment that categorizes risks as High, Medium, or Low. This approach is BEST described as:

Accepted Answer

Qualitative risk analysis

Answer

Qualitative risk analysis uses descriptive categories (High/Medium/Low) rather than numerical monetary values to rank risks.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Assessment 2