PCIP Risk Management & Data Protection Strategies 2 — Questions and Answers
Question 1: A merchant discovers that its third-party delivery application is storing full PANs in plaintext log files. Under PCI DSS, which immediate action is the HIGHEST priority?
- Notify the card brands within 24 hours
- Stop the storage of full PANs and delete existing plaintext log data (Correct answer)
- Encrypt the log files using AES-128
- Rotate all encryption keys used by the application
Correct answer: Stop the storage of full PANs and delete existing plaintext log data
PCI DSS Requirement 3 prohibits storing sensitive authentication data after authorization; the immediate priority is to cease the prohibited storage and purge existing data.
Question 2: Which risk treatment option involves transferring the financial consequences of a risk to another party, such as purchasing cyber insurance?
- Risk avoidance
- Risk mitigation
- Risk acceptance
- Risk transfer (Correct answer)
Correct answer: Risk transfer
Risk transfer shifts the financial burden of a risk to a third party (e.g., insurer or outsourced vendor) rather than bearing it internally.
Question 3: Under PCI DSS v4.0, what is the minimum key length required for RSA keys used to protect cardholder data?
- 1024 bits
- 2048 bits (Correct answer)
- 256 bits
- 4096 bits
Correct answer: 2048 bits
PCI DSS v4.0 requires RSA keys to be at least 2048 bits to be considered cryptographically strong.
Question 4: A payment processor uses a hardware security module (HSM) for key management. Which HSM function directly prevents clear-text keys from ever appearing outside the device?
- Key ceremony logging
- Key encryption key (KEK) wrapping (Correct answer)
- Dual control enforcement
- Key custodian assignment
Correct answer: Key encryption key (KEK) wrapping
A KEK wraps (encrypts) other keys so they can only be exported in encrypted form, ensuring clear-text keys never leave the HSM boundary.
Question 5: An organization wants to reduce its PCI DSS scope by routing all cardholder data through a third-party tokenization service. Which outcome correctly describes the scope reduction?
- All systems are removed from scope because a third party processes the data
- Systems that only handle tokens and never see PANs can be considered out of scope (Correct answer)
- Tokenization eliminates the need for a qualified security assessor (QSA) audit
- The card brands no longer require compliance validation once tokenization is deployed
Correct answer: Systems that only handle tokens and never see PANs can be considered out of scope
Systems that handle only irreversible tokens and have no access to the PANs or the token vault can be excluded from PCI DSS scope.
Question 6: During a risk assessment, the likelihood of a SQL injection attack is rated 'High' and the impact is rated 'High.' According to a standard risk matrix, what is the resulting risk level?
- Low
- Medium
- High
- Critical (Correct answer)
Correct answer: Critical
A High likelihood combined with High impact produces a Critical (or highest-tier) risk rating on a standard 4×4 or 5×5 risk matrix.
Question 7: PCI DSS Requirement 12.3 mandates that organizations perform a targeted risk analysis for certain customized controls. What must this analysis include?
- A full network penetration test conducted by an ASV
- Identification of the assets being protected, the threats, and the likelihood and impact of each threat (Correct answer)
- Approval from the acquiring bank before implementing the control
- An automated vulnerability scan of all in-scope systems
Correct answer: Identification of the assets being protected, the threats, and the likelihood and impact of each threat
PCI DSS v4.0 requires targeted risk analyses to document assets, threats, and the likelihood and impact of exploitation to justify customized implementations.
PCIP Risk Management & Data Protection Strategies 2
A merchant discovers that its third-party delivery application is storing full PANs in plaintext log files.
Under PCI DSS, which immediate action is the HIGHEST priority?