PCIP Security Monitoring 5 — Questions and Answers
Question 1: Which scenario BEST illustrates a 'low and slow' attack that standard threshold-based monitoring might miss?
- A DDoS attack sending 10 Gbps of traffic to a payment gateway
- An attacker exfiltrating one card record per hour over several weeks (Correct answer)
- A brute-force attack making 1,000 login attempts per minute
- Ransomware encrypting all files on a CDE server within minutes
Correct answer: An attacker exfiltrating one card record per hour over several weeks
Low-and-slow attacks deliberately stay below detection thresholds by spreading malicious activity over extended time periods, requiring behavioral analytics to detect.
Question 2: What is the role of User and Entity Behavior Analytics (UEBA) in a PCI DSS monitoring strategy?
- Replace firewall rules with machine-learning models
- Detect anomalous user actions that deviate from established behavioral baselines (Correct answer)
- Encrypt user credentials stored in the SIEM
- Generate PCI DSS compliance reports automatically
Correct answer: Detect anomalous user actions that deviate from established behavioral baselines
UEBA uses machine learning to identify deviations from normal user and system behavior, helping detect insider threats and compromised accounts that rule-based tools miss.
Question 3: A PCI DSS audit reveals that IDS signatures have not been updated for 90 days. What is the PRIMARY risk?
- Increased network latency due to outdated rule processing
- New attack techniques and malware variants will not be detected (Correct answer)
- IDS will generate excessive false positives
- Log storage capacity will be exceeded faster
Correct answer: New attack techniques and malware variants will not be detected
Outdated IDS signatures cannot detect newly discovered attack methods, leaving the CDE vulnerable to threats that emerged after the last update.
Question 4: Which approach BEST supports forensic investigation after a suspected card data breach?
- Immediately wipe and rebuild all CDE systems to contain the breach
- Preserve log integrity by creating forensic images before any remediation (Correct answer)
- Restore systems from the most recent backup to ensure clean state
- Disable all monitoring tools to prevent the attacker from detecting the investigation
Correct answer: Preserve log integrity by creating forensic images before any remediation
Forensic imaging preserves the original evidence needed to determine the breach scope, attack vector, and timeline before any remediation alters the environment.
Question 5: Under PCI DSS, audit logs must include which of the following data elements?
- Full PANs to identify which cards were accessed
- User ID, event type, date/time, success/failure, and originating IP (Correct answer)
- Only the system hostname and event severity
- Employee social security numbers for accountability
Correct answer: User ID, event type, date/time, success/failure, and originating IP
PCI DSS Requirement 10.3 specifies that logs capture user identification, event type, date and time, success or failure indication, origination, and affected component.
Question 6: A security analyst receives an alert that a service account used for database backups is attempting to access cardholder tables it has never accessed before. This BEST illustrates which threat category?
- Denial of service attack
- Privilege escalation or compromised service account (Correct answer)
- SQL injection in the application layer
- Network-level man-in-the-middle attack
Correct answer: Privilege escalation or compromised service account
Unusual access by a service account beyond its normal scope suggests the account has been compromised or an attacker has escalated privileges to abuse it.
Question 7: Which PCI DSS requirement mandates that organizations use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network?
- Requirement 5
- Requirement 7
- Requirement 11 (Correct answer)
- Requirement 12
Correct answer: Requirement 11
PCI DSS Requirement 11 covers security testing, including the use of intrusion-detection and intrusion-prevention systems to monitor all network traffic.
PCIP Security Monitoring 5
Which scenario BEST illustrates a 'low and slow' attack that standard threshold-based monitoring might miss?