quiz image

Information Security Policy and PCI DSS Overview Quiz

CommendableRuby avatar
CommendableRuby
·
·
Download

Start Quiz

9 Questions

Which one of the following is NOT covered by the Information Security Policy?

Physical site access and security

What is the responsibility of line managers according to the Information Security Policy?

Ensuring personnel receive training

What is the purpose of Requirement 11 of PCI DSS?

Tracking and monitoring all access to network resources and cardholder data

What is the purpose of the DMZ (Demilitarized Zone) in network security?

Exposing an organization's external-facing services to the Internet

Which of the following is NOT compliant with PCI DSS?

Monitoring or intercepting data on a public network

What is Sensitive Authentication Data (SAD) according to PCI DSS?

Full magnetic stripe data

What does Requirement 9 of PCI DSS mandate?

Assigning a unique ID to each person with computer access

What is the purpose of Requirement 12 of PCI DSS?

Regularly testing security systems and processes

What does Cardholder Data (CHD) include according to PCI DSS?

Primary account number (PAN)

Study Notes

Information Security Policy Document Control

  • The document is a draft version of an Information Security Policy for an unspecified company.

  • The policy sets out high-level objectives for information security, but does not provide specific guidance on how to achieve them.

  • The policy covers personnel responsibilities, network security, system builds, data security, anti-virus, patching and vulnerability management, software development, change management, access control, physical security, system logging, network testing, and monitoring tools.

  • Personnel are responsible for understanding their information security responsibilities, protecting credentials, attending training, and reporting security incidents.

  • Line managers are responsible for ensuring personnel receive training, have access to policies and procedures, and have their access revoked upon leaving employment.

  • Senior management roles include the Information Security Manager, Policy Manager, SOC Manager, Incident Response Manager, and those responsible for user account management and access monitoring.

  • Network security requirements include firewall management, documentation, architecture, and configuration, as well as secure management of wireless networks.

  • System builds must adhere to configuration standards, remove default settings, and use secure management services.

  • Data storage and transmission must comply with specific requirements for protecting cardholder data and using encryption.

  • Anti-virus must be deployed on all affected systems and centrally managed.

  • Patching and vulnerability management require the application of vendor updates and the management of vulnerabilities using the Common Vulnerability Scoring System (CVSS).

  • The policy covers secure software development practices, change management procedures, access control policies, physical site access and security, system logging configurations, network testing methodologies, and the use of monitoring tools such as intrusion detection and prevention systems (IDS/IPS) and file integrity monitoring (FIM).Requirements and Terminology of Payment Card Industry Data Security Standard (PCI DSS)

  • Requirement 9 of PCI DSS mandates assigning a unique ID to each person with computer access.

  • Requirement 10 of PCI DSS requires restricting physical access to cardholder data.

  • Requirement 11 of PCI DSS states that all access to network resources and cardholder data must be tracked and monitored.

  • Requirement 12 of PCI DSS emphasizes the need to regularly test security systems and processes.

  • Annex A of PCI DSS provides a glossary of terms for better understanding.

  • PCI DSS is a standard developed by the PCI Security Standards Council for entities handling cardholder data.

  • Insecure services, such as unencrypted data transmission or vulnerable platforms like torrents, Skype, SMTP, and DNS, are not compliant with PCI DSS.

  • A public network is any network not managed by the organization and can be monitored or intercepted by other entities.

  • A DMZ, or Demilitarized Zone, is a subnet that exposes an organization's external-facing services to the Internet.

  • Inbound traffic refers to data flowing into the organization from outside, while outbound traffic refers to data flowing out of the organization.

  • Sensitive Authentication Data (SAD) includes full magnetic stripe data, PINs, and other information used in relation to payment cards.

  • Cardholder data (CHD) includes the primary account number (PAN), cardholder name, and expiration date.

Test your knowledge on high-level objectives for information security policy documents and key requirements of the Payment Card Industry Data Security Standard (PCI DSS). The quiz covers topics such as personnel responsibilities, network security, system builds, data security, anti-virus, patching, vulnerability management, secure software development, and PCI DSS requirements.

Make Your Own Quizzes and Flashcards

Convert your notes into interactive study material.

Get started for free
Use Quizgecko on...
Browser
Browser