Pcip Study Aide

Front 1

PCI DSS Requirement 1

Back 1

Install and maintain a firewall configuration to protect cardholder data

Front 2

PCI DSS Requirement 2

Back 2

Do not use vendor supplied defaults for system passwords and other security parameters

Front 3

PCI DSS Requirement 3

Back 3

Protect stored cardholder data by enacting a formal data retention policy and implement secure deletion methods

Front 4

PCI DSS Requirement 4

Back 4

Protected Cardholder Data during transmission over the internet, wireless networks or other open access networks or systems (GSM, GPRS, etc.)

Front 5

PCI DSS Requirement 5

Back 5

Use and regularly update anti-virus software or programs

Front 6

PCI DSS Requirement 6

Back 6

Develop and maintain secure systems and applications

Front 7

PCI DSS Requirement 7

Back 7

Restrict access to cardholder data by business need to know

Front 8

PCI DSS Requirement 8

Back 8

Assign a unique ID to each person with computer access

Front 9

PCI DSS Requirement 9

Back 9

Restrict physical access to cardholder data

Front 10

PCI DSS Requirement 10

Back 10

Track and monitor all access to network resources and cardholder data

Front 11

PCI DSS Requirement 11

Back 11

Regularly test security systems and processes with wireless scans, vulnerability scans, log audits, ASV (Approved Scanning Vendor)

Front 12

PCI DSS Requirement 12

Back 12

Maintain a policy that addresses information security for all personnel

Front 13

PCI Data Security Standards (PCI DSS)

Back 13

Covers the security of the environments that store, process or transmit account data.

Environments receive account data from payment applications and other sources (e.g. acquirers)

Front 14

PCI Payment Application Data Security Standards
(PCI PA-DSS)

Back 14

Covers secure payment applications to support PCI DSS compliance.

Payment application receives account data from PIN Entry Devices (PED) or other devices and begins payment transaction

Front 15

PCI PIN Transaction Security (PCI PTS)

Back 15

Covers device tamper detection, cryptographic processes and other mechanisms to protect the Personal Identification Number (PIN).

Encrypted PIN is passed to payment application or hardware terminal.

Front 16

PCI PIN Security

Back 16

Covers secure management, processing and transmission of personal identification number data during online and offline payment card transaction processing

Front 17

PCI Point to Point Encryption (PCI P2PE)

Back 17

Covers encryption, decryption and key management within secure cryptographic devices (SCD).

Front 18

CDE

Back 18

Cardholder Data Environment

Front 19

Relationship between PTS and PCI DSS

Back 19

DSS prevents the storage of encrypted PIN blocks. PTS supports the PIN encryption so there's no overlap.

Front 20

Relationship between PCI DSS and PA-DSS

Back 20

Paymnet applications must support and not hinder PCI DSS compliance

PCI DSS requirements mirrored in many payment application requirements in PA-DSS

Front 21

Relationship between PCI DSS and P2PE

Back 21

Incorporates requirements from Pin Transaction Security, PCI DSS, PA-DSS and PCI PIN to protect CHD from the point of capture until it reaches the payment processor.

Properly implemented, validated P2PE solutions may help reduce the scope of a merchant's PCI DSS assessment.

Front 22

CHD

Back 22

Card Holder Data

Front 23

PA-DSS applies to third party payment applications

Back 23

if application performs authorization and/or settlement (POS, shopping carts, etc.)

Front 24

PA-DSS ensure a payment application functions

Back 24

in a PCI DSS compliant manner by supporting the compliance of those that use the application.

Front 25

Use of a PA-DSS application alone

Back 25

does not guarantee PCI DSS compliance.

Front 26

Assessor must validate that payment application is installed

Back 26

per instructions in the PA-DSS implementation Guide provided by payment application vendor and in a PCI DSS compliant manner.

Front 27

PTS requirements apply to:

Back 27

Point of Interaction (POI) devices
Encrypting PIN Pads (EPP)
Point of Sale devices (POS)
Hardware/host Security Modules (HSM)
Unattended Payment Terminals (UPT)
non-PIN entry modules

Front 28

PTS ensures terminals cannot be

Back 28

manipulated or attacked to allow the capture of sensitive authentication data nor allow access to clear-text PINS or keys

Front 29

SRED

Back 29

Secure Read and Exchange Module

Front 30

The SRED allows terminals to be

Back 30

approved for the secure encryption of cardholder data as part of the P2PE program.

Front 31

PTS has been extended to allow non-PIN entry modules

Back 31

to be evaluated against the SRED module to allow secure encryption at the point of interaction for non-chip and PIN cards.

Front 32

A PCI DSS assessor must validate that the payment application is installed

Back 32

per PA-DSS implementation guide

and in a PCI DSS compliant manner

Front 33

POI

Back 33

Point of Interaction

Front 34

There are two types of devices addressed by PTS...

Back 34

Point of Interaction (POI)

Hardware Security Modules (HSM)

Front 35

Points of Interaction are broken into _____ device types....

Back 35

3---

Attended POS devices such as cash registers

Encrypting PIN pads for use in unattended environments such as ATM's

Unattended payment terminals such as automated fuel dispensers and kiosks.

Front 36

PIN (Personal Identification Number) security is comprised of

Back 36

secure management, processing and transmission of PIN data during online and offline payment card transaction processing - such as POS terminals (attended or unattended) and ATMs

Front 37

P2PE

Back 37

Point to Point Encryption

Front 38

Using a P2PE hardware to hardware solution may reduce

Back 38

the scope of the cardholder data environment

Front 39

P2PE addresses merchants who

Back 39

..do not store or decrypt encrypted data within their environment and who use validated solutions consisting of hardware-based encryption and third-party hardware-based encryption

Front 40

P2PE solutions typically consist of

Back 40

a secure encryption device at the merchant premises (PTS validated POI device), all applications on the Point of Interaction device and secure decryption and key management in the service provider's environment.

Front 41

PCI DSS scope can be reduced on the merchant side because

Back 41

merchants have no access to account data within POI or decryption environment

merchants have no involvement in crypto key management

all crypto operations managed by solution provider

Front 42

Cardholder

Back 42

the person actually owns the payment card

Front 43

Cardholder purchases goods either as a

Back 43

Card present or card not present transaction

Front 44

The cardholder receives the card and bills from

Back 44

the issuer.

Front 45

The issuer is

Back 45

the bank or other organization issuing a payment card on behalf of a payment brand (i.e. Visa, MC)

Front 46

Can the issuer be a payment brand directly?

Back 46

Yes

Front 47

The merchant is

Back 47

the organization accepting the payment card for payment during a purchase

Front 48

PAN

Back 48

Primary Account Number

Front 49

PAN, Cardholder name, expiration date, service code are all examples of

Back 49

cardholder data.

Front 50

SAD

Back 50

Sensitive Authentication Data

Front 51

full magnetic stripe data or equivalent on a chip, CAV2/CVC2/CVV2/CID, PINs/PIN blocks...are all examples of

Back 51

SAD (sensitive authentication data)

Front 52

If the PAN or SAD is stored processed or transmitted, are the PCI DSS requirements applicable?

Back 52

Yes

Front 53

Sensitive Authentication Data ________________ be stored after authorization.

Back 53

Cannot

Front 54

Does encryptiong Cardholder data or SAD remove it from scope?

Back 54

No, not necessarily

Front 55

Track data or track equivalent data

Back 55

Data stored on a magnetic strip or equivalent data encoded on a chip

Front 56

Chip track data contains a unique chip CVV/CVC code which prevents ___________ the magnetic stripe.

Back 56

Cloning

Front 57

The PAN and expiration data in the chip can be used for fraudulent card-not-present transactions...true or false?

Back 57

True

Front 58

Contains all fields of both Track 1 and Track 2 and is up to 79 characters

Back 58

Track 1 on the magnetic stripe

Front 59

Provides shorter processing time for older dial up transmissions and is up to 40 characters

Back 59

Track 2 on magnetic stripe

Front 60

Issuers and issuing processors may be permitted to retain sensitive authentications data after authorization if needed for business purposes - T or F?

Back 60

True

Front 61

Businesses may have a need to store track data temporarily for troubleshooting purposes - tracks mis-reads, network errors, encryption issues, etc. TorF?

Back 61

True

Front 62

Requirements for a firewall at each internet connection and between any demilitarized zone and the internal network zone - t or f?

Back 62

True

Front 63

Requirment to review firewall and router rule sets at least every _____ months

Back 63

6

Front 64

Firewalls do not have to be installed between all wireless networks and the CDE - regardless of the purpose of the environment to which the wireless network is connected - t or f?

Back 64

False

Front 65

Is the implementation of a DMZ recommended?

Back 65

Yes

Front 66

Firewalls should be stateful - true or false?

Back 66

True

Front 67

Segregate system components that store cardholder data (such as a database) in an internal network zone, separate from the DMZ and other untrusted networks t or F?

Back 67

True

Front 68

Cardholder data within the DMZ makes it easier or harder for the external attacker to access?

Back 68

Easier

Front 69

The implementation of multiple functions on one server is encouraged - t or f?

Back 69

False

Front 70

Are there additional requirements for shared hosting providers?

Back 70

Yes - Appendix A

Front 71

Use a one way hash of entire PAN as a way or rendering PAN unreadable - t or f?

Back 71

True

Front 72

A cryptoperiod is a time span during which a particular cryptographic key can be used for its defined purpose - true or false?

Back 72

True

Front 73

Which NIST SP is used for guidance on cryptographic measures for PCI?

Back 73

800-57

Front 74

______-knowledge and dual control of keys is used to eliminate one person's access to the whole key.

Back 74

Split

Front 75

The use of WEP as a security control was prohibited as of June 30, 2010 - true or false?

Back 75

True

Front 76

Keep your **** patched - always within two months of patch release - true or false?

Back 76

False - answer is one month

Front 77

The intention of this requirement is that organizations keep up to date with new vulnerabilities that may impact their environment

Back 77

PCI DSS Requirement 6

Front 78

The ranking of vulnerabilities is a requirement enacted June 30, 2012 - t or f?

Back 78

True

Front 79

Security must be at the table during requirements definition, design, etc. - t or false?

Back 79

T

Front 80

Production data (live PANs) are used for testing and development - true or false?

Back 80

F

Front 81

The P2PE standard covers...

Back 81

encryption, decryption and key management within Secure Cryptographic Devices (SCD)

Front 82

The PCI DSS applies to any entity that ________, _________, or ____________ cardholder data.

Back 82

stores, processes, transmits

Front 83

The PCI DSS follows a defined ______________ lifecycle.

Back 83

36 month

Front 84

Providing:
-authorization services to a merchant
-clearing services to a merchant
-settlement services to a merchant
are functions associated with an _____________?

Back 84

Acquirer

Front 85

Who approves a purchase?

Back 85

Issuing bank

Front 86

Is clearing, auth and settlement the correct order for a payment card transaction?

Back 86

No - auth, clearing, settlement is the correct order

Front 87

Service providers can control or impact the security of the cardholder data - t or f?

Back 87

True

Front 88

Cardholder data may be stored in 'KNOWN' and 'UNKNOWN' locations - t or f?

Back 88

True

Front 89

Track data can be stored long term or persistently if the ____________ is storing it.

Back 89

issuer

Front 90

Req. 3.4 states that PAN must be rendered unreadable when stored, using encryption, hashing or truncation - true or false?

Back 90

True

Front 91

Rlogon, telnet and ftp are secure services - true or false?

Back 91

False

Front 92

Which requirement concerns controlling access to data?

Back 92

7

Front 93

'least privilege'

Back 93

when access is granted only to the least amount of data and privileges needed to perform a job

Front 94

RBAC

Back 94

when privileges are assigned to individual on the basis of their job classification and function

Front 95

Two factor auth applies to users that have remote access to the network, where that remote access could lead to access to the cardholder data environment and is required for networks with access to the CDE- t or f?

Back 95

true

Front 96

Password change every 90 - t or f?

Back 96

True

Front 97

Min length is 8 - true or false?

Back 97

false - min is 7

Front 98

no repeats of last three pwords used - t or f?

Back 98

false - no repeat of last 4

Front 99

3 attempt lock out - true or false?

Back 99

False - 6 attempts

Front 100

lockout duration is 30 mins - true or false?

Back 100

true

Front 101

session idle timeout is 10 mins - true or false?

Back 101

false - timeout for session idle is 15 mins

Front 102

Logging is a highly critical part of the security posture - true or false?

Back 102

True - how else can activity be tracked?

Front 103

Retain audit trail history for at least _____ year/s with a minimum of _______ months immediately available.

Back 103

1
3

Front 104

Perform external and internal pen testing at least once a year and after any significant upgrade or modification - t or f?

Back 104

True

Front 105

FIM

Back 105

file integrity monitoring tools

Front 106

Perform a risk assessment annually - t or f?

Back 106

true

Front 107

Create an __________ ___________ plan to be implemented in the event of system breach.

Back 107

incident response - tested annually

Front 108

SAQ

Back 108

Self Assessment questionnaire

Front 109

A validation tool intended to assist merchants and service providers in self-evaluating their compliance with the PCI DSS

Back 109

SAQ

Front 110

Name the 5 SAQs

Back 110

A, B, C, D, C-VT

Front 111

SAQ A

Back 111

Card not present merchants, all cardholder data source functions outsourced

Front 112

SAQ B

Back 112

Imprint only merchants with no electronic cardholder data storage or stand alone dial out terminals with no electronic cardholder data storage

Front 113

SAQ C-VT

Back 113

merchants with web-based virtual terminals, no electronic cardholder data storage

Front 114

SAQ C

Back 114

Merchants with payment application systems connected to the internet, no electronic cardholder data storage

Front 115

SAQ D

Back 115

All other merchants and all service providers defined by a payment brand as eligible to complete an SAQ

Front 116

tokenization

Back 116

process by which a PAN is replaced with a surrogate value called a token.

Front 117

de-tokenization

Back 117

process by which a token is redeemed for its associated PAN value

Front 118

Storing tokens instead of PANs is one alternative to reduce the amount of cardholder data in the environment - t or f?

Back 118

true

Front 119

Tokenization solutions complicate validation efforts - t or f?

Back 119

False - they actually reduce the number of system components covered by PCI DSS

Front 120

Virtualization

Back 120

separates applications, desktops, machines, networks, data and services from their physical constraints

Front 121

If virtualization is used in a CDE, PCI DSS requirments do not apply - t or f?

Back 121

f

Front 122

Encryption

Back 122

the algorithmic process of transforming plaintext into unreadable ciphertext.

Front 123

P2PE encrypts at source, delivers information encrypted and then decrypted at destination - t or f?

Back 123

true

Front 124

A compensating control may be considered for most PCI DSS requirments when an entity cannot meet a requirement explicitly as stated due to technical or documented business constraints and can be removed after the assessment is complete - t or f?

Back 124

false - compensating control must remain effective after assessment

Front 125

Meet the rigor and intent of the original requirement

Back 125

compensating control

Front 126

sufficiently offset the risk that the original requirement was designed to defend against

Back 126

compensating control

Front 127

be above and beyond other PCI DSS requirements

Back 127

compensating control

Front 128

be commensurate with additional risk imposed by not adhering to the original requirement

Back 128

compensating control

Front 129

Two reasons for consideration of compensating controls:

Back 129

Legit technical or documented business constraint

Front 130

Existing PCI DSS requirements CANNOT be considered as compensating controls if there are already required for the item under review - t or f?

Back 130

t

Front 131

Existing PCI DSS requirements CAN be considered as compensating controls if they are not already required for the item under review - t or f?

Back 131

t