PCIP Risk Management & Data Protection Strategies 3 — Questions and Answers
Question 1: Which data protection technique replaces a PAN with a randomly generated value that has no exploitable relationship to the original, and the mapping is stored in a separate vault?
- Truncation
- Hashing
- Tokenization (Correct answer)
- Format-preserving encryption
Correct answer: Tokenization
Tokenization substitutes the PAN with a surrogate token, with the original PAN stored only in a secure vault, making the token itself valueless if stolen.
Question 2: A PCIP candidate is reviewing a company's compensating controls worksheet. Which condition MUST be met for a compensating control to be acceptable under PCI DSS?
- It must be less expensive than the original control
- It must go above and beyond the intent of the original requirement (Correct answer)
- It must be approved by the card brand before implementation
- It must be implemented by a QSA-certified vendor
Correct answer: It must go above and beyond the intent of the original requirement
PCI DSS requires compensating controls to provide an equivalent or greater level of defense than the original requirement, effectively going above and beyond its intent.
Question 3: What is the purpose of a Business Impact Analysis (BIA) in the context of payment card data protection?
- To determine which employees have access to cardholder data
- To quantify the operational and financial consequences of losing access to critical systems or data (Correct answer)
- To assign risk scores to individual vulnerabilities in the card processing environment
- To validate that encryption keys meet PCI DSS strength requirements
Correct answer: To quantify the operational and financial consequences of losing access to critical systems or data
A BIA identifies and quantifies the impact of disruptions to critical business functions, informing recovery time objectives and data protection priorities.
Question 4: Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD) that must NEVER be stored after authorization?
- Cardholder name
- Primary Account Number (PAN)
- Card Verification Value (CVV2) (Correct answer)
- Service code
Correct answer: Card Verification Value (CVV2)
CVV2 (and equivalent codes like CVC2, CID) is classified as SAD and is explicitly prohibited from storage at any point after authorization.
Question 5: An assessor is evaluating an organization's key management procedures. Which practice demonstrates proper split knowledge for cryptographic keys?
- One person holds the full key but must log every use
- Two or more people each hold a different component of the key, and no single person can reconstruct it alone (Correct answer)
- The key is stored in an encrypted file and the password is held by IT management
- The key is rotated every 90 days with automated tooling
Correct answer: Two or more people each hold a different component of the key, and no single person can reconstruct it alone
Split knowledge requires dividing a key into components distributed among separate custodians so no individual can reconstruct the key unilaterally.
Question 6: A retailer's risk register lists 'card skimming on POS terminals' as a high-priority risk. Which control BEST mitigates this threat?
- Implementing a web application firewall (WAF)
- Performing periodic physical inspection and tamper checks of POS devices (Correct answer)
- Encrypting all data in transit using TLS 1.2 or higher
- Deploying intrusion detection systems on the corporate network
Correct answer: Performing periodic physical inspection and tamper checks of POS devices
Physical inspection and tamper checks directly address card skimming by detecting unauthorized device modifications or overlays before data can be compromised.
Question 7: Which PCI DSS requirement category governs the implementation and maintenance of vulnerability management programs?
- Requirement 3 – Protect stored account data
- Requirement 5 – Protect all systems and networks from malicious software
- Requirement 6 – Develop and maintain secure systems and software (Correct answer)
- Requirement 11 – Test security of systems and networks regularly
Correct answer: Requirement 6 – Develop and maintain secure systems and software
Requirement 6 covers secure development, patch management, and the overall vulnerability management lifecycle for systems and software.
PCIP Risk Management & Data Protection Strategies 3
Which data protection technique replaces a PAN with a randomly generated value that has no exploitable relationship to the original, and the mapping is stored in a separate vault?