PCIP Risk Management & Data Protection Strategies 3

Question 1

Which data protection technique replaces a PAN with a randomly generated value that has no exploitable relationship to the original, and the mapping is stored in a separate vault?

Accepted Answer

Tokenization

Answer

Tokenization substitutes the PAN with a surrogate token, with the original PAN stored only in a secure vault, making the token itself valueless if stolen.

Question 2

A PCIP candidate is reviewing a company's compensating controls worksheet. Which condition MUST be met for a compensating control to be acceptable under PCI DSS?

Accepted Answer

It must go above and beyond the intent of the original requirement

Answer

PCI DSS requires compensating controls to provide an equivalent or greater level of defense than the original requirement, effectively going above and beyond its intent.

Question 3

What is the purpose of a Business Impact Analysis (BIA) in the context of payment card data protection?

Accepted Answer

To quantify the operational and financial consequences of losing access to critical systems or data

Answer

A BIA identifies and quantifies the impact of disruptions to critical business functions, informing recovery time objectives and data protection priorities.

Question 4

Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD) that must NEVER be stored after authorization?

Accepted Answer

Card Verification Value (CVV2)

Answer

CVV2 (and equivalent codes like CVC2, CID) is classified as SAD and is explicitly prohibited from storage at any point after authorization.

Question 5

An assessor is evaluating an organization's key management procedures. Which practice demonstrates proper split knowledge for cryptographic keys?

Accepted Answer

Two or more people each hold a different component of the key, and no single person can reconstruct it alone

Answer

Split knowledge requires dividing a key into components distributed among separate custodians so no individual can reconstruct the key unilaterally.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Management & Data Protection Strategies 3