PCIP Risk Management & Data Protection Strategies 4

Question 1

An e-commerce organization implements point-to-point encryption (P2PE) using a PCI-validated P2PE solution. What is the PRIMARY scope reduction benefit?

Accepted Answer

Merchant systems that only handle encrypted data and cannot decrypt it may be removed from CDE scope

Answer

A validated P2PE solution encrypts card data at the point of interaction, so merchant systems that handle only ciphertext and cannot decrypt it can be excluded from the cardholder data environment.

Question 2

What does the term 'residual risk' mean in a payment security risk management program?

Accepted Answer

The risk that remains after all planned controls have been applied

Answer

Residual risk is the level of risk that persists after existing or planned controls have been applied, which management must then accept, transfer, or further mitigate.

Question 3

A payment organization must restrict access to cardholder data to only those individuals whose job function requires it. Which security principle does this BEST represent?

Accepted Answer

Need to know

Answer

The need-to-know principle limits data access to individuals whose specific role requires that information, directly aligning with PCI DSS Requirement 7.

Question 4

Under PCI DSS v4.0, how frequently must a targeted risk analysis be performed for controls where the entity defines its own frequency?

Accepted Answer

At least annually

Answer

PCI DSS v4.0 requires that targeted risk analyses be reviewed and updated at least once every 12 months to remain relevant.

Question 5

Which attack specifically targets the cardholder data environment by intercepting network traffic to capture PANs transmitted in cleartext between systems?

Accepted Answer

Packet sniffing (network eavesdropping)

Answer

Packet sniffing captures unencrypted network packets, making cleartext PAN transmissions visible to an attacker with network access.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Management & Data Protection Strategies 4