Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PCIP > PCI Standard & Your Professional Role > Flashcards

PCI Standard & Your Professional Role Flashcards

1
Q

An independent industry standards body providing oversight of the development and management of Payment Card Industry Data Security Standards on a global basis.

A

PCI SSC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

PCI SSC founding payment brands include:

A
  • American Express
  • Discover Financial
  • JCB International
  • MasterCard
  • Visa
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The resources provided by PCI SSC:

A
  • PCI DSS, PA-DSS, P2PE, PTS(POI, HSM and PIN),Card Production, and supporting documents - PCI Security Standards Council FAQs
  • Education and outreach programs
  • Roster of QSAs, PA-QSAs, PCIPs, ASVs, validated payment applications, PTS Devices, and P2PE solutions
  • Participating organization membership, community meetings, feedback
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Each payment brand develops and maintain its own ————— programs in accordance with its own security risk management policies

A

PCI DSS compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Security Operating Policy (DSOP)

A

American Express

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Discover Information Security Compliance (DISC)

A

Discover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Security Program

A

JCB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Site Data Protection(SDP)

A

MasterCard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cardholder Information Security Program (CISP) Account Information Security (AIS) Program

A

VISA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Payment brands’ compliance programs include:

A
  • Tracking and enforcement - Penalties, feed, compliance deadlines
  • Validation process and who needs to validate
  • Definition of merchant and service provider levels
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Payment brands are also responsible for:

A
  • Defining rules for forensic investigations and responding to account data compromises
  • Monitoring and facilitating investigations of account data compromises to completion
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Covers Security of the environments that store, process, or transmit account data

A

PCI DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Covers secure payment applications to support PCI DSS compliance

A

PCI PA-DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Covers encryption, decryption, and key management requirements for point-to-point encryption solutions

A

PCI P2PE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Covers the protection of sensitive data at point-of-interaction devices and their secure components

A

PCI PTS-POI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Covers secure management,processing and transmission of personal identification number (PIN) data

A

PCI PTS-PIN Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Covers physical,logical,and device security requirements for securing Hardware Security Modules (HSM)

A

PCI PTS-HSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Covers physical and logical security requirements for entities involved in producing payment cards

A

PCI Card Production

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Covers physical and logical security requirements for Token Service Providers that generate and issue EMV Payment Tokens

A

PCI Token Service Provider Requirements (TSP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Covers the risk framework to protect the confidentiality and integrity of sensitive payment information captured and processed on a cardholder verification method (CVM) solution

A

PCI Software-Based PIN Entry on COTS Security Requirements (SPoC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Covers the secure design and development processes of payment software. (Transition Plan for PA-DSS)

A

PCI Software Security Standard (S3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Covers the security requirements for assessing 3-D Secure (3DS) entities that perform the following 3DS functions:

  • Access Control Server(ACS)
  • Directory Server (DS)
  • 3DS Server (3DSS)
A

PCI 3DS Core Security Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Covers the security requirements for “app based” 3-D Secure Software Development Kits(SDK) as defined in the 3-D Secure SDL Specification managed and maintained by EMVCo

A

PCI 3DS SDK Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Functions of Payment Application Data Security Standard (PA-DSS)

A
  • Provides a list of validated applications to choose from
  • Validated applications are proven to facilitate PCI DSS compliance
    • Does it guarantee compliance?
  • For applications that are sold/licensed to others
  • Must have a PA-DSS Implementation Guide
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Roles of Qualified Integrator and Reseller (QIR)

A
  • Are certified to perform Qualified Installations of Payment applications
  • Focus on 3 problems: remote access, accounts and passwords, patching.
  • Leave behind an Implementation statement saying what they did
  • The Implementation statement is not an evaluation or certification of compliance
  • Purely Informational
  • Could list problems found

Note: Even though the software vendor may have developed an application which is capable of being secure, the integrator/Reseller must ensure it is implemented properly and in a secure manner to facilitate PCI DSS compliance

26
Q

Is the algorithm process of transforming plaintext into unreadable cipher text, and is the core technology for any point-to-point encryption solution

A

Encryption

27
Q

In _______________ encryption occurs at one designated and independently validated encryption device or location in a card transaction (the source or encryption point), and the data is sent as unreadable cipher text for decryption to another designated and independently validated decryption device (the destination or decryption point). The data remains encrypted between the source and the destination, with no decryption of the data feasible at any point between the two points

A

P2PE solutions

28
Q

The __________ is that encrypted cardholder data in transit is protected to the extent that an entity in possession of the cipher text alone cannot reverse the encryption process

A

Presumption of P2PE

29
Q

A PCI P2PE solution must include all of the following:

A
  • Secure encryption of payment card data at the point-of-interaction (POI)
  • P2PE-validated application(s) at the point-of-interaction
  • Secure management of encryption and decryption devices
  • Management of the decryption environment and all decrypted account data
  • Use of secure encryption methodologies and cryptographic key operations, including key generation, distribution, loading/injection, administration and usage
30
Q

Merchants may be able to reduce their PCI DSS scope when using Council-listed P2PE solutions:

A
  • Merchant has no access to account data within encryption device (POI) or decryption environment (at Solution Provider) - Merchant has no involvement in encryption or decryption operations, or cryptographic key management - All cryptographic operations managed by third party Solution Provider
31
Q

PCI DSS applies to all entities involved in payment card processing, and any entity that _______,_______, or _______ account data

A

Stores, processes, or transmits

32
Q

___________ covers security for any system components included in or connected to a merchant’s or service provider’s cardholder data environment (CDE)

A

PCI DSS

33
Q

What are the relationships to PA-DSS and PCI DSS

A
  • Payment applications must facilitate and not prevent PCI DSS compliance - Many payment application requirements in PA-DSS address equivalent PCI DSS requirements
34
Q

What are the relationships to P2PE and PCI DSS?

A
  • Incorporates requirements from PTS, PCI DSS, PA-DSS, and PCI PIN to protect account data from the point of capture until it reaches the payment processor - When properly implemented and maintained, Council-listed P2PE solutions may help reduce work involved during a merchant’s PCI DSS assessment
35
Q

PTS requirements apply to….

A
  • Point of Interaction (POI) Devices - Encrypting PIN Pads (EPP) - Point of Sale devices (POS) - Hardware (or host) Security Modules (HSMs) - Unattended Payment Terminals (UPTs) - Non-PIN Entry module
36
Q

The PTS Program ensures terminals cannot be 1️⃣________ or 2️⃣__________ to allow the capture of 3️⃣_____________, nor allow access to 4️⃣_________ PINs or keys

A

1️⃣ manipulated 2️⃣ attacked 3️⃣ Sensitive Authentication data 4️⃣ clear-text

37
Q

The 1️⃣________________, allows terminals to be approved for the secure encryption of cardholder data as part of the point to point encryption program

A

1️⃣ Secure Read and Exchange Module (SRED)

38
Q

1️⃣_____ has been extended to allow non-PIN entry modules to be evaluated against the SRED module to allow secure encryption at the point of interaction for non-chip and PIN cards

A

PTS

39
Q

These requirements provide for secure PIN:

A

✔️Management ✔️Processing ✔️Transmission

40
Q

Protection of personal identification number (PIN) data during online and offline payment card transaction processing at:

A

🔹ATMs 🔹Attended point-of-sale (POS) terminals 🔹Unattended point-of-sale (POS) terminals

41
Q

The ______________ also provide guidance on key management and key handling associated with the PIN

A

PCI PIN Security requirements

42
Q

PCI PTS-POI and PCI DSS

A

💬PCI DSS requires that account data be protected both when stored and when transmitted across open, public networks

💬PCI PTS POI validates how POIs protect PIN and account data and manage cryptographic keys

💬PCI PTS POI approved devices may form part of a PCI DSS compliant environment

43
Q

PCI PTS -PIN Security Standard and PCI DSS

A

💬PCI DSS prohibits storage of encrypted PIN blocks 💬No overlap

44
Q

PCI Card Production and PCI DSS

A

💬No overlap

💬Procedures for assessing Card production facilities are defined and managed by the payment brands, not by PCI SSC

45
Q

PCI PTS-HSM and PCI DSS

A

💬PCI DSS requires that stored cardholder data be protected and cryptographic keys be managed in a secure manner

💬Used of a Hardware Security Module is not required by PCI DSS, but may help with handling and managing keys used to protect stored cardholder data

46
Q

To ensure information security professionals adhere to the highest standards of ethical and professional conduct

A

Code of Professional Responsibility

47
Q

All PCI SSC Qualified individuals and all PCI SSC qualification candidates must agree to advocate, adhere to, and support the following Code of Professional Responsibility include:

A

🔸Professional Competence and Due Care 🔸Security and Confidentiality 🔸Integrity 🔸Compliance with Industry Laws and Standards

48
Q

A PCIP qualification is valid for _________

A

3 years

49
Q

Payment Card Industry Terminology

A
50
Q

Customer purchasing goods either as a “Card Present” or “Card Not Present” transaction Receives the payment card and bills from the issuer

A

Cardholder

51
Q

Bank or other organization issuing a payment card on behalf of a Payment Brand (e.g. MasterCard & Visa) Payment Brand issuing a payment card directly (e.g. Amex, Discover, JCB)

A

Issuer

52
Q

Organization accepting the payment card for payment during a purchase

A

Merchant

53
Q

Bank or entity the merchant uses to process their payment card transactions Receive authorization request from merchant and forward to Issuer for approval Provide authorization, clearing and settlement services to merchants

A

Acquirer

54
Q

Acquirer is also called:

A
  • Merchant Bank
  • ISO(sometimes)
  • Payment Brand-Amex, Discover, JCB
  • Never Visa or MasterCard
55
Q

Draw the diagram of Card Processing-Authorization steps

A
56
Q

Draw the diagram of Card Processing-Clearing steps

A
57
Q

Draw the diagram of Card Processing-Settlement steps

A
58
Q

A business that is not a payment brand, directly involved in the processing, storage or transmission of cardholder data on behalf of another entity.

A

Service Providers

59
Q

Sometimes a service provider is a _________

A

merchant

60
Q

There are two options for third-party service providers to validate compliance:

A
  • Undergo a PCI DSS assessment on their own and provide evidence to their customers demonstrating their compliance

or

  • Have their services reviewed during the course of each of their customers’ PCI DSS assessments
61
Q

It’s important to understand where the service provider’s scope begins and ends for PCI DSS, for example:

A
  • The service(s) included in the service provider’s PCI DSS validation.
  • The PCI DSS requirements covered by the service provider’s PCI DSS validation.
  • Any PCI DSS requirements related to the service which are the responsibility of the service provider’s customers to maintain.
  • The date of the service provider’s last PCI DSS validation.
  • The type and frequency of evidence provided by the service provider to their customers will depend on the agreement between those parties.
  • Entities must monitor the PCI DSS compliance of their third-party service providers per PCI DSS Requirement 12.8 (Maintain and implement policies and procedures to manage service providers with which cardholder data is shared, or that could affect the security of cardholder data)

PCIP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions