PCIP Security Monitoring 5

Question 1

Which scenario BEST illustrates a 'low and slow' attack that standard threshold-based monitoring might miss?

Accepted Answer

An attacker exfiltrating one card record per hour over several weeks

Answer

Low-and-slow attacks deliberately stay below detection thresholds by spreading malicious activity over extended time periods, requiring behavioral analytics to detect.

Question 2

What is the role of User and Entity Behavior Analytics (UEBA) in a PCI DSS monitoring strategy?

Accepted Answer

Detect anomalous user actions that deviate from established behavioral baselines

Answer

UEBA uses machine learning to identify deviations from normal user and system behavior, helping detect insider threats and compromised accounts that rule-based tools miss.

Question 3

A PCI DSS audit reveals that IDS signatures have not been updated for 90 days. What is the PRIMARY risk?

Accepted Answer

New attack techniques and malware variants will not be detected

Answer

Outdated IDS signatures cannot detect newly discovered attack methods, leaving the CDE vulnerable to threats that emerged after the last update.

Question 4

Which approach BEST supports forensic investigation after a suspected card data breach?

Accepted Answer

Preserve log integrity by creating forensic images before any remediation

Answer

Forensic imaging preserves the original evidence needed to determine the breach scope, attack vector, and timeline before any remediation alters the environment.

Question 5

Under PCI DSS, audit logs must include which of the following data elements?

Accepted Answer

User ID, event type, date/time, success/failure, and originating IP

Answer

PCI DSS Requirement 10.3 specifies that logs capture user identification, event type, date and time, success or failure indication, origination, and affected component.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Monitoring 5