PCIP Security Technologies & Network Architecture 5 — Questions and Answers
Question 1: Which of the following BEST describes the role of a Security Information and Event Management (SIEM) system in a PCI DSS environment?
- It replaces the need for firewalls by blocking malicious traffic in real time
- It aggregates and correlates log data from across the CDE to detect security events and support forensic investigation (Correct answer)
- It encrypts all log data before storage to meet Requirement 3
- It automatically patches vulnerabilities identified in network scans
Correct answer: It aggregates and correlates log data from across the CDE to detect security events and support forensic investigation
A SIEM centralizes logs from CDE systems, correlates events across sources, and generates alerts, directly supporting PCI DSS Requirements 10.4 and 10.7 for log review and retention.
Question 2: Under PCI DSS, what is required if a wireless network is present in the environment but is NOT connected to the CDE?
- No action required; wireless networks outside the CDE are always out of scope
- The organization must ensure the wireless network cannot reach the CDE and must perform quarterly scans for unauthorized wireless access points (Correct answer)
- All wireless networks must be disabled unless they use WPA3
- Wireless networks outside the CDE must be encrypted with WEP
Correct answer: The organization must ensure the wireless network cannot reach the CDE and must perform quarterly scans for unauthorized wireless access points
Even wireless networks not connected to the CDE must be monitored for rogue access points that could bridge into the CDE, per PCI DSS Requirement 11.2.
Question 3: Which of the following is a characteristic of 'split tunneling' that makes it a security concern in PCI DSS remote access scenarios?
- Split tunneling encrypts only half of the remote session's traffic
- Split tunneling allows a remote device to access both the CDE VPN and the internet simultaneously, potentially creating a bypass path into the CDE (Correct answer)
- Split tunneling requires administrative privileges that violate least-privilege requirements
- Split tunneling disables multi-factor authentication on VPN sessions
Correct answer: Split tunneling allows a remote device to access both the CDE VPN and the internet simultaneously, potentially creating a bypass path into the CDE
With split tunneling, a compromised remote device connected to the CDE VPN can also have its internet-connected interface leveraged as a pivot point, violating PCI DSS isolation requirements.
Question 4: What is the purpose of file integrity monitoring (FIM) in the context of PCI DSS Requirement 11?
- To encrypt sensitive files at rest in the CDE
- To detect unauthorized changes to critical system files, configuration files, and content files on CDE systems (Correct answer)
- To back up cardholder data to a secure off-site location
- To monitor user login attempts and enforce password policies
Correct answer: To detect unauthorized changes to critical system files, configuration files, and content files on CDE systems
FIM generates baseline hashes of critical files and alerts when any unauthorized modification is detected, helping identify malware implantation or unauthorized configuration changes.
Question 5: An organization is evaluating cloud hosting for its payment application. Which statement is MOST accurate regarding PCI DSS scope in cloud environments?
- Cloud environments are inherently out of PCI DSS scope because the cloud provider handles all security
- The organization retains responsibility for its own PCI DSS compliance even in the cloud; the scope of the cloud provider's responsibility depends on the service model and a validated shared responsibility agreement (Correct answer)
- Using a PCI DSS-certified cloud provider automatically makes the hosted application compliant
- Cloud environments require only a SAQ A regardless of the payment flows involved
Correct answer: The organization retains responsibility for its own PCI DSS compliance even in the cloud; the scope of the cloud provider's responsibility depends on the service model and a validated shared responsibility agreement
PCI DSS compliance in the cloud operates under a shared responsibility model; even with a compliant cloud provider, the customer must ensure its own in-scope configurations, applications, and data handling meet PCI DSS requirements.
Question 6: A security team discovers that a CDE system is communicating with an external IP on port 6667 (IRC). What is the most likely security implication in a PCI DSS context?
- The system is using an approved encrypted communication channel
- The system may be infected with malware using IRC for command-and-control communication, representing a potential cardholder data breach (Correct answer)
- Port 6667 is required for PCI DSS log forwarding
- This is a normal payment processor communication pattern
Correct answer: The system may be infected with malware using IRC for command-and-control communication, representing a potential cardholder data breach
IRC (port 6667) is a classic channel for botnet command-and-control; unauthorized outbound communication on this port from a CDE system strongly suggests malware infection requiring immediate incident response.
Question 7: Under PCI DSS, which of the following is required regarding cryptographic key management when encryption is used to protect stored cardholder data?
- Encryption keys may be stored in the same database as the encrypted cardholder data for operational convenience
- Key management procedures must include key generation, distribution, storage, retirement, and destruction, with access to keys restricted to the fewest custodians necessary (Correct answer)
- Keys must be rotated annually unless the merchant demonstrates no breach has occurred
- Any symmetric encryption algorithm is acceptable as long as the key length exceeds 64 bits
Correct answer: Key management procedures must include key generation, distribution, storage, retirement, and destruction, with access to keys restricted to the fewest custodians necessary
PCI DSS Requirement 3.7 mandates a complete key management lifecycle with documented procedures, strong generation methods, secure storage separate from the data, and strict access controls.
PCIP Security Technologies & Network Architecture 5
Which of the following BEST describes the role of a Security Information and Event Management (SIEM) system in a PCI DSS environment?