PCIP Risk Assessment 5

Question 1

In the NIST SP 800-30 risk assessment framework, which step directly follows threat and vulnerability identification?

Accepted Answer

Likelihood determination

Answer

After identifying threats and vulnerabilities, NIST SP 800-30 calls for determining the likelihood that a threat will exploit a vulnerability.

Question 2

Which of the following BEST describes the purpose of network segmentation in the context of PCI DSS risk reduction?

Accepted Answer

It reduces the scope and attack surface of the cardholder data environment

Answer

Network segmentation limits the CDE scope by isolating cardholder data systems, thereby reducing the number of systems subject to PCI DSS requirements and the overall attack surface.

Question 3

A risk assessment finds that a payment terminal vendor's remote access credentials are shared among multiple technicians. The PRIMARY risk this creates is:

Accepted Answer

Inability to attribute actions to individuals, undermining accountability

Answer

Shared credentials prevent individual accountability, making it impossible to trace malicious or erroneous actions to a specific person, which violates PCI DSS access control principles.

Question 4

Which of the following scenarios represents risk AVOIDANCE as a treatment strategy?

Accepted Answer

Discontinuing a high-risk paper-based order process that captures full PANs

Answer

Risk avoidance eliminates the risk entirely by stopping the activity that creates it, such as discontinuing a risky business process.

Question 5

When prioritizing risk remediation in a PCI DSS environment, which factor should be weighted MOST heavily?

Accepted Answer

The combination of likelihood and impact on cardholder data confidentiality

Answer

Prioritization should focus on risks with high likelihood of exploitation and high potential impact on cardholder data, aligning remediation efforts with actual CDE exposure.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Assessment 5