PCIP Risk Assessment 3

Question 1

In quantitative risk analysis, Annualized Loss Expectancy (ALE) is calculated as:

Accepted Answer

ALE = Single Loss Expectancy × Annualized Rate of Occurrence

Answer

ALE equals SLE multiplied by ARO, representing the expected annual financial loss from a specific risk.

Question 2

Which risk treatment option involves purchasing cyber insurance to cover potential cardholder data breach losses?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial impact of a risk to a third party, such as an insurer, without eliminating the underlying risk.

Question 3

A new e-commerce checkout feature is being deployed that will process card-not-present transactions. When should a risk assessment be conducted?

Accepted Answer

Before the feature is deployed, as a significant environmental change

Answer

PCI DSS requires risk assessments upon significant changes to the cardholder data environment, and a new payment feature qualifies as such a change.

Question 4

Which asset classification BEST describes PANs stored in an encrypted database within the cardholder data environment?

Accepted Answer

Sensitive cardholder data requiring protection

Answer

PANs are classified as sensitive cardholder data and must be protected per PCI DSS even when encrypted, as they remain within scope.

Question 5

During a risk assessment workshop, a stakeholder suggests accepting a high-rated risk because remediation is too costly. As a PCIP, you should:

Accepted Answer

Document the formal risk acceptance with executive sign-off and set a review date

Answer

Risk acceptance is a valid treatment option but must be formally documented with executive approval and a defined review timeline.

(PCIP) Payment Card Industry Professional Practice Test