PCIP Security Monitoring 3

Question 1

Which network security monitoring technique captures and inspects packet headers and payloads traversing the CDE?

Accepted Answer

Deep Packet Inspection (DPI)

Answer

Deep Packet Inspection examines both headers and payload content, enabling detection of malicious data within network traffic in the CDE.

Question 2

A file integrity monitoring (FIM) solution alerts on a change to a system binary on a CDE server. What should the security team do FIRST?

Accepted Answer

Determine whether the change was authorized via change management records

Answer

FIM alerts must be correlated with change management records to determine if the modification was authorized before escalating further.

Question 3

Under PCI DSS, which systems within the CDE MUST have their logs collected and reviewed?

Accepted Answer

All system components in the CDE

Answer

PCI DSS Requirement 10 applies to all system components within the cardholder data environment, not just storage systems.

Question 4

What is a key difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

Accepted Answer

IDS alerts on threats passively; IPS can actively block malicious traffic

Answer

An IDS detects and alerts on suspicious activity without blocking it, while an IPS can automatically block or drop malicious traffic in real time.

Question 5

Which log entry attribute is MOST critical for correlating events across multiple CDE systems?

Accepted Answer

Synchronized timestamps

Answer

Synchronized timestamps ensure that events on different systems can be accurately correlated in time, which is essential for incident investigation.

(PCIP) Payment Card Industry Professional Practice Test