APRP Physical and Information Security 3 — Questions and Answers
Question 1: A payments organization uses multi-factor authentication (MFA). Which combination correctly represents three different authentication factors?
- Password, PIN, and security question
- Smart card, fingerprint, and one-time passcode (Correct answer)
- Password, username, and employee ID
- Retina scan, voice print, and face scan
Correct answer: Smart card, fingerprint, and one-time passcode
Smart card (something you have), fingerprint (something you are), and OTP (something you have/know) span three distinct factor categories.
Question 2: Which attack exploits physical proximity to skim contactless payment card data without the cardholder's knowledge?
- SQL injection
- RFID/NFC eavesdropping (Correct answer)
- Phishing
- Cross-site scripting
Correct answer: RFID/NFC eavesdropping
RFID/NFC eavesdropping captures contactless card data from a short distance using a covert reader.
Question 3: What is the purpose of a Hardware Security Module (HSM) in a payment processing environment?
- To provide physical server cooling
- To securely generate, store, and manage cryptographic keys (Correct answer)
- To monitor network traffic for intrusions
- To perform load balancing across payment servers
Correct answer: To securely generate, store, and manage cryptographic keys
An HSM is a tamper-resistant physical device that manages cryptographic keys and performs encryption operations securely.
Question 4: Under PCI DSS, which media type requires secure destruction when no longer needed to protect cardholder data?
- Only paper documents
- Only magnetic stripe media
- All physical and electronic media containing cardholder data (Correct answer)
- Only media holding primary account numbers (PAN)
Correct answer: All physical and electronic media containing cardholder data
PCI DSS Requirement 9 requires secure destruction of all media types — paper, electronic, optical — that contain cardholder data.
Question 5: An employee working from home accesses the corporate payment platform. Which control is MOST important to mandate?
- The employee uses a personal device with antivirus
- VPN with MFA connecting to the corporate network (Correct answer)
- Use of a public Wi-Fi with WEP encryption
- Saving cardholder data to a personal cloud drive for backup
Correct answer: VPN with MFA connecting to the corporate network
A VPN with MFA ensures encrypted, authenticated access to payment systems from remote locations.
Question 6: Which physical security control is specifically designed to detect and alert on unauthorized removal of payment terminals from their installed locations?
- Biometric door locks
- Anti-tampering tilt and motion sensors on terminals (Correct answer)
- HVAC environmental monitoring
- Fire suppression systems
Correct answer: Anti-tampering tilt and motion sensors on terminals
Tilt and motion sensors trigger alerts when terminals are moved or manipulated, helping detect skimmer installations.
Question 7: What is the MAIN risk of printing cardholder data (such as PANs) on receipts or reports in a payments environment?
- It increases paper costs
- Printed data can be stolen, lost, or improperly disposed of, exposing sensitive account information (Correct answer)
- It slows down transaction processing
- Printers are always connected to the internet
Correct answer: Printed data can be stolen, lost, or improperly disposed of, exposing sensitive account information
Printed cardholder data creates physical copies that can be accessed by unauthorized individuals if not properly secured and destroyed.
APRP Physical and Information Security 3
A payments organization uses multi-factor authentication (MFA).
Which combination correctly represents three different authentication factors?