PCIP Security Monitoring 3 — Questions and Answers
Question 1: Which network security monitoring technique captures and inspects packet headers and payloads traversing the CDE?
- Passive DNS monitoring
- Deep Packet Inspection (DPI) (Correct answer)
- SNMP polling
- Syslog forwarding
Correct answer: Deep Packet Inspection (DPI)
Deep Packet Inspection examines both headers and payload content, enabling detection of malicious data within network traffic in the CDE.
Question 2: A file integrity monitoring (FIM) solution alerts on a change to a system binary on a CDE server. What should the security team do FIRST?
- Approve the change if it matches a scheduled maintenance window
- Disable FIM alerts to reduce noise
- Determine whether the change was authorized via change management records (Correct answer)
- Reinstall the operating system immediately
Correct answer: Determine whether the change was authorized via change management records
FIM alerts must be correlated with change management records to determine if the modification was authorized before escalating further.
Question 3: Under PCI DSS, which systems within the CDE MUST have their logs collected and reviewed?
- Only servers that store PANs
- All system components in the CDE (Correct answer)
- Only internet-facing firewalls
- Only systems processing transactions over $10,000
Correct answer: All system components in the CDE
PCI DSS Requirement 10 applies to all system components within the cardholder data environment, not just storage systems.
Question 4: What is a key difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
- IDS encrypts traffic; IPS does not
- IDS alerts on threats passively; IPS can actively block malicious traffic (Correct answer)
- IPS only works on wireless networks; IDS works on wired networks
- IDS requires agent installation; IPS is agentless
Correct answer: IDS alerts on threats passively; IPS can actively block malicious traffic
An IDS detects and alerts on suspicious activity without blocking it, while an IPS can automatically block or drop malicious traffic in real time.
Question 5: Which log entry attribute is MOST critical for correlating events across multiple CDE systems?
- Log file size
- Synchronized timestamps (Correct answer)
- Server hostname length
- Log rotation frequency
Correct answer: Synchronized timestamps
Synchronized timestamps ensure that events on different systems can be accurately correlated in time, which is essential for incident investigation.
Question 6: A QSA reviewing a merchant's PCI DSS compliance finds no documented process for responding to IDS alerts. Which requirement is violated?
- Requirement 3 — Protect Stored Cardholder Data
- Requirement 6 — Develop Secure Systems
- Requirement 10 — Track and Monitor All Access (Correct answer)
- Requirement 12 — Maintain an Information Security Policy
Correct answer: Requirement 10 — Track and Monitor All Access
Requirement 10 encompasses monitoring and requires documented processes for reviewing and responding to security alerts from detection tools.
Question 7: Which indicator would BEST suggest a compromised POS terminal is exfiltrating card data?
- Increased CPU usage during peak transaction hours
- Unusual outbound connections to foreign IP addresses during off-hours (Correct answer)
- Slow transaction processing speed at checkout
- Expired TLS certificate on the terminal
Correct answer: Unusual outbound connections to foreign IP addresses during off-hours
Malware on POS devices commonly beacons or exfiltrates harvested card data to external command-and-control servers, often during low-traffic periods.
PCIP Security Monitoring 3
Which network security monitoring technique captures and inspects packet headers and payloads traversing the CDE?