PCIP Security Technologies & Network Architecture 3 — Questions and Answers
Question 1: Under PCI DSS, what is the required frequency for testing firewall and router rule sets?
- Once every two years
- At least every six months (Correct answer)
- Only when a significant change occurs
- Daily, using automated tools
Correct answer: At least every six months
PCI DSS Requirement 1.2.7 requires that firewall and router configurations be reviewed at least every six months to ensure rules remain appropriate and unauthorized changes are identified.
Question 2: A company implements a web application firewall (WAF) in front of its payment page. According to PCI DSS Requirement 6, what is true about this control?
- A WAF eliminates the need for secure coding practices for the payment application
- A WAF is one of two acceptable options to address Requirement 6.4 for public-facing web applications, the other being a code review process (Correct answer)
- A WAF only needs to be configured once and requires no ongoing updates
- A WAF satisfies all requirements under PCI DSS Requirement 11
Correct answer: A WAF is one of two acceptable options to address Requirement 6.4 for public-facing web applications, the other being a code review process
PCI DSS Requirement 6.4 gives merchants the option of either a WAF or a regular vulnerability review/code audit for protecting public-facing web applications from known attack techniques.
Question 3: Which technology is specifically designed to detect and alert on suspicious activity by analyzing network traffic patterns within the CDE?
- Network Access Control (NAC)
- Intrusion Detection System (IDS) (Correct answer)
- Data Loss Prevention (DLP)
- Public Key Infrastructure (PKI)
Correct answer: Intrusion Detection System (IDS)
An IDS monitors network traffic for suspicious patterns and known attack signatures, alerting security staff to potential intrusions within or targeting the CDE.
Question 4: What is the purpose of network time protocol (NTP) synchronization in a PCI DSS-compliant environment?
- To encrypt log data before storage
- To ensure all system clocks are synchronized for accurate and consistent log timestamps used in forensic investigations (Correct answer)
- To automatically update firewall rules based on time of day
- To reduce network latency for payment transactions
Correct answer: To ensure all system clocks are synchronized for accurate and consistent log timestamps used in forensic investigations
PCI DSS Requirement 10.6 requires time synchronization so that log timestamps across all CDE systems are consistent, which is essential for correlating events during security investigations.
Question 5: An organization uses tokenization for storing customer payment data. What does tokenization do in the context of PCI DSS?
- Encrypts the PAN with a symmetric key stored in the same database
- Replaces the PAN with a non-sensitive surrogate value (token) that has no exploitable value outside the tokenization system (Correct answer)
- Masks the last four digits of the PAN in all systems
- Converts the PAN into a hashed value stored alongside the original
Correct answer: Replaces the PAN with a non-sensitive surrogate value (token) that has no exploitable value outside the tokenization system
Tokenization replaces the real PAN with a token, and because the token has no mathematical relationship to the original PAN, systems storing only tokens are generally considered out of PCI DSS scope.
Question 6: Which of the following best describes a 'stateful' firewall's advantage over a 'stateless' packet filter in protecting the CDE?
- Stateful firewalls are faster because they don't track connection state
- Stateful firewalls track the state of active connections and can detect and block packets that don't belong to a legitimate established session (Correct answer)
- Stateful firewalls automatically apply deep packet inspection for all traffic
- Stateful firewalls eliminate the need for IDS/IPS in the CDE
Correct answer: Stateful firewalls track the state of active connections and can detect and block packets that don't belong to a legitimate established session
Stateful firewalls maintain a connection table and can identify and drop malformed or spoofed packets that don't match any legitimate established connection, providing stronger protection than simple packet filtering.
Question 7: Under PCI DSS, which of the following must be prohibited for traffic flowing into the CDE from the internet?
- HTTPS traffic on port 443 to a payment web server
- Direct inbound connections from the internet to internal IP addresses in the CDE without passing through a DMZ (Correct answer)
- Encrypted API calls from partner payment processors
- DNS queries to a CDE-hosted authoritative DNS server
Correct answer: Direct inbound connections from the internet to internal IP addresses in the CDE without passing through a DMZ
PCI DSS Requirement 1.3 prohibits direct internet access to CDE systems; all inbound internet traffic must pass through a DMZ or other demarcation layer before reaching internal CDE systems.
PCIP Security Technologies & Network Architecture 3
Under PCI DSS, what is the required frequency for testing firewall and router rule sets?