PCIP Security Technologies & Network Architecture 2

Question 1

Which network segmentation approach most effectively reduces PCI DSS scope by isolating the cardholder data environment (CDE)?

Accepted Answer

Implementing firewall-enforced network segmentation with documented access controls

Answer

PCI DSS requires firewall-enforced segmentation with documented controls to isolate the CDE and reduce scope; VLANs alone are insufficient without enforced access policies.

Question 2

An IDS detects a port scan originating from within the internal network toward CDE systems. What is the FIRST appropriate response under PCI DSS incident response requirements?

Accepted Answer

Contain the potential threat, preserve evidence, and notify the security team per the incident response plan

Answer

PCI DSS Requirement 12.10 mandates following a documented incident response plan that includes containment and evidence preservation as initial steps.

Question 3

What is the primary purpose of a demilitarized zone (DMZ) in a PCI DSS-compliant network architecture?

Accepted Answer

To host public-facing systems while preventing direct access to the internal network and CDE

Answer

A DMZ isolates public-facing components (web servers, payment gateways) from the internal network, preventing attackers who compromise DMZ systems from directly reaching the CDE.

Question 4

Under PCI DSS, which protocol should be used for remote administrative access to CDE systems?

Accepted Answer

SSH or TLS with multi-factor authentication

Answer

PCI DSS Requirement 8.6 prohibits insecure protocols like Telnet and requires encrypted protocols such as SSH or TLS with MFA for remote administrative access to CDE.

Question 5

A retailer uses a point-to-point encryption (P2PE) solution validated by PCI SSC. What is the primary PCI DSS scope reduction benefit?

Accepted Answer

Card data is encrypted at the point of interaction, so systems that handle only encrypted data may be descoped

Answer

Validated P2PE solutions encrypt card data at the terminal, so downstream systems that only process ciphertext are generally out of scope, reducing the merchant's compliance footprint.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Technologies & Network Architecture 2