PCIP Risk Management & Data Protection Strategies 5

Question 1

A service provider processes cardholder data for multiple merchants. Under PCI DSS, what document must the service provider supply to each merchant to clarify shared compliance responsibilities?

Accepted Answer

A responsibility matrix (shared responsibility matrix)

Answer

PCI DSS requires service providers to maintain a documented responsibility matrix that explicitly states which requirements are managed by the provider and which remain the merchant's responsibility.

Question 2

Which cryptographic concept ensures that a sender cannot later deny having sent a message, and is often used in digital payment audit trails?

Accepted Answer

Non-repudiation

Answer

Non-repudiation uses digital signatures or audit logs to prove the origin of a transaction, preventing parties from falsely denying their actions.

Question 3

A QSA discovers that an organization's anti-malware solution has not been updated for 45 days on several servers in the cardholder data environment. Which PCI DSS requirement is MOST directly violated?

Accepted Answer

Requirement 5 – Protect all systems from malicious software

Answer

Requirement 5 mandates that anti-malware solutions be kept current, including virus definitions and engine updates, on all in-scope systems.

Question 4

What is the primary goal of data minimization as a risk reduction strategy in payment card environments?

Accepted Answer

Limiting the volume and retention of cardholder data to reduce breach impact

Answer

Data minimization reduces the amount and retention period of cardholder data, shrinking the attack surface and limiting the harm if a breach occurs.

Question 5

An organization's penetration test reveals that an internal system can reach PAN data stores without passing through a network segmentation control. What is the MOST appropriate remediation?

Accepted Answer

Implement and enforce network segmentation to isolate the cardholder data environment from other networks

Answer

Proper network segmentation (e.g., firewalls, VLANs with access controls) isolates the CDE, preventing out-of-scope systems from reaching cardholder data.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Risk Management & Data Protection Strategies 5