APRP Physical and Information Security 4 — Questions and Answers
Question 1: In payments security, what is 'data masking' PRIMARILY used for?
- Encrypting data in transit between systems
- Replacing sensitive data with realistic but fictitious values in non-production environments (Correct answer)
- Backing up cardholder data to offsite storage
- Compressing large transaction files
Correct answer: Replacing sensitive data with realistic but fictitious values in non-production environments
Data masking substitutes real cardholder data with realistic dummy values so developers and testers can work without exposing live account numbers.
Question 2: Which type of social engineering attack targets specific high-value individuals within a payments organization, such as the CFO or CTO?
- Vishing
- Spear phishing (whaling) (Correct answer)
- Smishing
- Pretexting via helpdesk
Correct answer: Spear phishing (whaling)
Whaling is a targeted spear phishing attack aimed at senior executives to authorize fraudulent payments or disclose credentials.
Question 3: A rogue employee copies cardholder data to a personal thumb drive before leaving the company. Which control would BEST have prevented this?
- Regular password changes
- Data Loss Prevention (DLP) tools with USB port blocking (Correct answer)
- Annual security awareness training
- Intrusion detection system on the perimeter firewall
Correct answer: Data Loss Prevention (DLP) tools with USB port blocking
DLP with USB port control prevents unauthorized copying of sensitive data to removable media.
Question 4: PCI DSS requires that all default passwords on payment system components be changed. Why is this critical?
- Default passwords are too short for system performance
- Default passwords are publicly known and easily exploited by attackers (Correct answer)
- Changing passwords resets admin audit logs
- Vendors require password changes for warranty compliance
Correct answer: Default passwords are publicly known and easily exploited by attackers
Default credentials are documented in vendor manuals and widely known; leaving them unchanged is one of the most common and easily exploited vulnerabilities.
Question 5: What is the primary security benefit of using point-to-point encryption (P2PE) in a card-present payment environment?
- It speeds up transaction authorization times
- It encrypts cardholder data immediately at the point of interaction, preventing merchant systems from ever seeing plaintext card data (Correct answer)
- It eliminates the need for PCI DSS compliance entirely
- It authenticates the identity of the cardholder
Correct answer: It encrypts cardholder data immediately at the point of interaction, preventing merchant systems from ever seeing plaintext card data
P2PE encrypts card data at the terminal before it reaches merchant systems, greatly reducing the risk of cardholder data theft and PCI DSS scope.
Question 6: Which framework specifically governs information security risk management for payment card industry participants?
- HIPAA Security Rule
- PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)
- SOX IT Controls
- NIST SP 800-53 alone
Correct answer: PCI DSS (Payment Card Industry Data Security Standard)
PCI DSS is the primary standard governing security requirements for entities that store, process, or transmit payment card data.
Question 7: What is 'shoulder surfing' in a payments security context?
- An attack on wireless payment terminals via Bluetooth
- Visually observing someone entering a PIN or password without their knowledge (Correct answer)
- Installing a covert camera inside an ATM
- Eavesdropping on network traffic at a point of sale
Correct answer: Visually observing someone entering a PIN or password without their knowledge
Shoulder surfing involves looking over someone's shoulder to capture PINs, passwords, or other sensitive data being entered.
APRP Physical and Information Security 4
In payments security, what is 'data masking' PRIMARILY used for?