PCIP Risk Assessment 4

Question 1

Which PCI DSS document type formally records identified risks, their ratings, owners, and treatment plans?

Accepted Answer

Risk Register

Answer

A risk register is the formal document used to track identified risks, their assessed ratings, assigned owners, and planned or completed treatment actions.

Question 2

An organization's risk assessment reveals that unencrypted PANs traverse a legacy internal network segment. The FIRST step should be:

Accepted Answer

Identify and document all data flows to determine full scope of exposure

Answer

Before remediating, fully mapping and documenting all affected data flows ensures the complete scope of the exposure is understood and remediation is comprehensive.

Question 3

Which of the following BEST distinguishes inherent risk from residual risk?

Accepted Answer

Inherent risk exists before controls are applied; residual risk remains after controls

Answer

Inherent risk is the natural level of risk without any controls, while residual risk is what remains after controls have been implemented.

Question 4

A PCIP reviews a risk assessment that omits insider threat scenarios. This is a gap because:

Accepted Answer

Insider threats represent a significant and commonly exploited attack vector for cardholder data theft

Answer

Insider threats are a well-documented risk to cardholder data environments and must be included in comprehensive PCI DSS risk assessments.

Question 5

When using a risk matrix, a risk rated as 'Low Likelihood / High Impact' is MOST accurately described as:

Accepted Answer

A tail risk requiring monitoring and contingency planning

Answer

Low-likelihood, high-impact risks are often called tail risks; they warrant contingency planning and monitoring even if immediate mitigation isn't prioritized.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Assessment 4