PCIP Risk Management & Data Protection Strategies 2

Question 1

A merchant discovers that its third-party delivery application is storing full PANs in plaintext log files. Under PCI DSS, which immediate action is the HIGHEST priority?

Accepted Answer

Stop the storage of full PANs and delete existing plaintext log data

Answer

PCI DSS Requirement 3 prohibits storing sensitive authentication data after authorization; the immediate priority is to cease the prohibited storage and purge existing data.

Question 2

Which risk treatment option involves transferring the financial consequences of a risk to another party, such as purchasing cyber insurance?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial burden of a risk to a third party (e.g., insurer or outsourced vendor) rather than bearing it internally.

Question 3

Under PCI DSS v4.0, what is the minimum key length required for RSA keys used to protect cardholder data?

Accepted Answer

2048 bits

Answer

PCI DSS v4.0 requires RSA keys to be at least 2048 bits to be considered cryptographically strong.

Question 4

A payment processor uses a hardware security module (HSM) for key management. Which HSM function directly prevents clear-text keys from ever appearing outside the device?

Accepted Answer

Key encryption key (KEK) wrapping

Answer

A KEK wraps (encrypts) other keys so they can only be exported in encrypted form, ensuring clear-text keys never leave the HSM boundary.

Question 5

An organization wants to reduce its PCI DSS scope by routing all cardholder data through a third-party tokenization service. Which outcome correctly describes the scope reduction?

Accepted Answer

Systems that only handle tokens and never see PANs can be considered out of scope

Answer

Systems that handle only irreversible tokens and have no access to the PANs or the token vault can be excluded from PCI DSS scope.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Management & Data Protection Strategies 2