PCIP Security Technologies & Network Architecture 4

Question 1

What is the function of a Hardware Security Module (HSM) in a PCI DSS payment environment?

Accepted Answer

To securely generate, store, and manage cryptographic keys in tamper-resistant hardware

Answer

An HSM is a dedicated tamper-resistant device that protects the entire lifecycle of cryptographic keys, preventing key material from ever being exposed in plaintext outside the device.

Question 2

Which PCI DSS requirement governs the use of anti-malware solutions on systems in the CDE?

Accepted Answer

Requirement 5 — Protect All Systems and Networks from Malicious Software

Answer

PCI DSS Requirement 5 mandates deploying and maintaining anti-malware solutions on all systems commonly affected by malware, with mechanisms for regular updates and active protection.

Question 3

A merchant's payment application communicates with the processor over TLS 1.0. What action is required under PCI DSS?

Accepted Answer

Upgrade to TLS 1.2 or higher, as early TLS versions are prohibited and no longer considered strong cryptography

Answer

PCI DSS explicitly prohibits SSL and early TLS (1.0 and 1.1) for protecting cardholder data in transit; TLS 1.2 minimum (preferably 1.3) is required with no compensating control option.

Question 4

Which technique does PCI DSS recommend to prevent SQL injection attacks on applications that process cardholder data?

Accepted Answer

Using parameterized queries (prepared statements) to separate code from data

Answer

Parameterized queries ensure user-supplied input is always treated as data and never as executable SQL code, which is the most effective prevention for SQL injection.

Question 5

What is the primary security concern with using default vendor-supplied passwords on network devices in the CDE?

Accepted Answer

Default passwords are widely published and easily found by attackers, making systems trivially compromised

Answer

Attackers routinely use lists of known default credentials; PCI DSS Requirement 2.1 mandates changing all defaults before deploying any system component into the environment.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Technologies & Network Architecture 4