APRP Data Security & Privacy 1 — Questions and Answers
Question 1: What is the primary objective of the Payment Card Industry Data Security Standard (PCI DSS)?
- To establish interest rate caps on payment card transactions
- To protect cardholder data and reduce payment card fraud (Correct answer)
- To regulate the fees charged by card networks to merchants
- To standardize payment card form factors across all issuers
Correct answer: To protect cardholder data and reduce payment card fraud
PCI DSS was established to protect cardholder data environments and reduce payment card fraud by setting security requirements for all entities that store, process, or transmit cardholder data.
Question 2: Under PCI DSS, which data element is NEVER permitted to be stored after transaction authorization?
- Primary Account Number (PAN)
- Cardholder name
- Full magnetic stripe data (track data) (Correct answer)
- Card expiration date
Correct answer: Full magnetic stripe data (track data)
Full magnetic stripe data (track data) is classified as sensitive authentication data and must never be stored after authorization under any circumstances under PCI DSS.
Question 3: A merchant stores customer PANs in a database. Under PCI DSS, which method is acceptable for protecting stored PANs?
- Storing PANs in plain text within a secured physical data center
- Encrypting PANs using strong cryptography with proper key management (Correct answer)
- Hashing PANs using MD5 for storage efficiency
- Masking PANs only on screen displays but storing them in clear text
Correct answer: Encrypting PANs using strong cryptography with proper key management
PCI DSS requires that stored PANs be protected using strong cryptography with associated key management procedures.
Question 4: What does 'tokenization' accomplish in a payment security context?
- It encrypts cardholder data using a symmetric key
- It replaces sensitive cardholder data with a non-sensitive surrogate value (token) (Correct answer)
- It segments the payment network to isolate cardholder data
- It authenticates cardholders using biometric verification
Correct answer: It replaces sensitive cardholder data with a non-sensitive surrogate value (token)
Tokenization replaces sensitive cardholder data such as the PAN with a unique token that has no exploitable value outside the specific system that issued it.
Question 5: Which US federal law primarily governs the privacy of nonpublic personal financial information held by financial institutions, including payment service providers?
- Health Insurance Portability and Accountability Act (HIPAA)
- Gramm-Leach-Bliley Act (GLBA) (Correct answer)
- Children's Online Privacy Protection Act (COPPA)
- Electronic Communications Privacy Act (ECPA)
Correct answer: Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices and protect customers' nonpublic personal financial information.
Question 6: What is the purpose of network segmentation in a payment card data environment?
- To increase transaction throughput by distributing processing load
- To isolate the cardholder data environment from untrusted networks and reduce PCI DSS scope (Correct answer)
- To enable real-time fraud scoring across multiple data centers
- To comply with anti-money laundering reporting requirements
Correct answer: To isolate the cardholder data environment from untrusted networks and reduce PCI DSS scope
Network segmentation isolates the cardholder data environment (CDE) from other networks, reducing the scope of PCI DSS compliance and limiting the exposure of sensitive data.
APRP Data Security & Privacy 1
What is the primary objective of the Payment Card Industry Data Security Standard (PCI DSS)?