PCIP Security Technologies & Network Architecture 4 — Questions and Answers
Question 1: What is the function of a Hardware Security Module (HSM) in a PCI DSS payment environment?
- To provide physical access control to server rooms
- To securely generate, store, and manage cryptographic keys in tamper-resistant hardware (Correct answer)
- To act as a network-layer firewall for the CDE
- To perform real-time fraud detection on payment transactions
Correct answer: To securely generate, store, and manage cryptographic keys in tamper-resistant hardware
An HSM is a dedicated tamper-resistant device that protects the entire lifecycle of cryptographic keys, preventing key material from ever being exposed in plaintext outside the device.
Question 2: Which PCI DSS requirement governs the use of anti-malware solutions on systems in the CDE?
- Requirement 3 — Protect Stored Account Data
- Requirement 5 — Protect All Systems and Networks from Malicious Software (Correct answer)
- Requirement 8 — Identify Users and Authenticate Access to System Components
- Requirement 11 — Test Security of Systems and Networks Regularly
Correct answer: Requirement 5 — Protect All Systems and Networks from Malicious Software
PCI DSS Requirement 5 mandates deploying and maintaining anti-malware solutions on all systems commonly affected by malware, with mechanisms for regular updates and active protection.
Question 3: A merchant's payment application communicates with the processor over TLS 1.0. What action is required under PCI DSS?
- No action; TLS 1.0 is acceptable if a compensating control is documented
- Upgrade to TLS 1.2 or higher, as early TLS versions are prohibited and no longer considered strong cryptography (Correct answer)
- Downgrade to SSL 3.0 which is more widely compatible
- Add a WAF to compensate for TLS 1.0 weaknesses
Correct answer: Upgrade to TLS 1.2 or higher, as early TLS versions are prohibited and no longer considered strong cryptography
PCI DSS explicitly prohibits SSL and early TLS (1.0 and 1.1) for protecting cardholder data in transit; TLS 1.2 minimum (preferably 1.3) is required with no compensating control option.
Question 4: Which technique does PCI DSS recommend to prevent SQL injection attacks on applications that process cardholder data?
- Encrypting database fields that store cardholder data
- Using parameterized queries (prepared statements) to separate code from data (Correct answer)
- Storing all cardholder data in NoSQL databases
- Applying network-layer rate limiting to database connections
Correct answer: Using parameterized queries (prepared statements) to separate code from data
Parameterized queries ensure user-supplied input is always treated as data and never as executable SQL code, which is the most effective prevention for SQL injection.
Question 5: What is the primary security concern with using default vendor-supplied passwords on network devices in the CDE?
- Default passwords may be too complex for administrators to remember
- Default passwords are widely published and easily found by attackers, making systems trivially compromised (Correct answer)
- Default passwords don't meet minimum length requirements under PCI DSS
- Default passwords expire too frequently and cause system lockouts
Correct answer: Default passwords are widely published and easily found by attackers, making systems trivially compromised
Attackers routinely use lists of known default credentials; PCI DSS Requirement 2.1 mandates changing all defaults before deploying any system component into the environment.
Question 6: In the context of PCI DSS, what does 'egress filtering' on a CDE firewall accomplish?
- It blocks inbound connections from known malicious IP addresses
- It restricts outbound traffic from CDE systems to only authorized destinations and ports, helping prevent data exfiltration (Correct answer)
- It decrypts SSL traffic for inspection before allowing it outbound
- It performs NAT translation for internal CDE IP addresses
Correct answer: It restricts outbound traffic from CDE systems to only authorized destinations and ports, helping prevent data exfiltration
Egress filtering controls what CDE systems can communicate with externally, limiting attacker ability to exfiltrate cardholder data or establish command-and-control channels.
Question 7: A penetration test reveals that an internal CDE server can communicate directly with a public IP address on port 80. Under PCI DSS, this finding indicates a failure of which control?
- Requirement 3 — encryption of stored data
- Requirement 1 — firewall controls restricting outbound CDE traffic to only necessary communications (Correct answer)
- Requirement 8 — user authentication policies
- Requirement 12 — security policy documentation
Correct answer: Requirement 1 — firewall controls restricting outbound CDE traffic to only necessary communications
Unauthorized outbound connections from CDE systems violate PCI DSS Requirement 1, which mandates that firewalls restrict all traffic to and from the CDE to only what is explicitly required and authorized.
PCIP Security Technologies & Network Architecture 4
What is the function of a Hardware Security Module (HSM) in a PCI DSS payment environment?