[02/Magdalena/04]

To protect cardholder data and prevent fraud

The primary account number (PAN), expiration date, and service code

All organizations that process, store, or transmit cardholder data

True

False

True

PCI DSS = A set of security standards designed to protect cardholder data and prevent fraud Cardholder data = Any information that can be used to identify a cardholder and their payment card account PAN = The primary account number, a unique identifier for a payment card Service code = A three-digit or four-digit number on a magnetic stripe card that is used to authorize and encrypt transactions

Payment Card Industry Data Security Standard (PCI DSS) = A set of security standards that applies to all organizations that process, store, or transmit cardholder data Cardholder data = Includes the primary account number (PAN), expiration date, and service code PAN = A number that uniquely identifies a payment card Service code = A number on a payment card that is used to authorize and encrypt transactions

PCI DSS = A set of security standards that organizations must follow to protect cardholder data Cardholder data = Any information that can be used to identify a cardholder and their payment card account PAN = The primary account number, a unique identifier for a payment card Service code = A number on a payment card that is used to authorize and encrypt transactions

Protect cardholder data from unauthorized access, use, or disclosure = Implementation of physical, technical, and administrative safeguards Encrypt cardholder data at rest and in transit = Makes cardholder data unreadable to unauthorized individuals Use strong passwords and security controls on all systems = Includes firewalls, intrusion detection systems, and anti-virus software Regularly test and monitor systems and networks for vulnerabilities = Includes penetration tests and vulnerability assessments

Fines = Credit card brands can fine organizations for PCI DSS violations Loss of processing privileges = Credit card brands can revoke the ability of organizations to process credit card payments Damage to reputation = A data breach can damage an organization's reputation and lead to lost customers

PCI DSS = Payment Card Industry Data Security Standard Cardholder data = Information that can be used to identify a cardholder and their payment card account Data processing = The activities performed on cardholder data under PCI DSS

Primary Account Number (PAN) = A unique identifier for the cardholder's account Expiration Date = The date after which the payment card is no longer valid Service Code = A three-digit code used for various purposes, such as identifying the card's acceptance requirements

Firewalls = Used as a security control on systems that store, process, or transmit cardholder data Intrusion Detection Systems = Used as a security control on systems that store, process, or transmit cardholder data Anti-virus software = Used as a security control on systems that store, process, or transmit cardholder data

Risk assessment = Identify and mitigate potential security vulnerabilities Layered security approach = Includes physical, technical, and administrative safeguards Encryption = Protects cardholder data at rest and in transit System testing and monitoring = Regularly checking for vulnerabilities

Self-assessment = Organizations are responsible for assessing their own compliance Annual validation = Requires a Qualified Security Assessor (QSA) QSA = Independent auditor who specializes in PCI DSS compliance Training employees = Ensuring awareness and understanding of compliance

Physical safeguards = Protecting physical access to cardholder data Technical safeguards = Securing systems and networks Administrative safeguards = Establishing policies and procedures for data protection Strong passwords = Protecting systems that store, process, or transmit cardholder data

Cardholder data = Information such as the primary account number (PAN), expiration date, and service code PCI DSS = Set of security standards designed to protect cardholder data and prevent fraud QSA = Qualified Security Assessor, an independent auditor for PCI DSS compliance Annual validation = Process of verifying compliance with PCI DSS standards

Risk assessment = Identifies potential security vulnerabilities Encryption = Protects cardholder data from unauthorized access System testing and monitoring = Detects and addresses vulnerabilities Training employees = Ensures understanding and adherence to compliance requirements

PCI DSS = Payment Card Industry Data Security Standard QSA = Qualified Security Assessor, an independent auditor for PCI DSS compliance Cardholder data = Sensitive information related to payment cards Annual validation = Verification of compliance with PCI DSS standards

Risk assessment = Identify and mitigate potential security vulnerabilities Layered security approach = Includes physical, technical, and administrative safeguards Encryption = Protects cardholder data at rest and in transit System testing and monitoring = Regularly checking for vulnerabilities

Cardholder data = Information such as the primary account number (PAN), expiration date, and service code PCI DSS = Set of security standards designed to protect cardholder data and prevent fraud QSA = Qualified Security Assessor, an independent auditor for PCI DSS compliance Annual validation = Process of verifying compliance with PCI DSS standards

Physical safeguards = Protecting physical access to cardholder data Technical safeguards = Securing systems and networks Administrative safeguards = Establishing policies and procedures for data protection Strong passwords = Protecting systems that store, process, or transmit cardholder data

PCI DSS = Payment Card Industry Data Security Standard QSA = Qualified Security Assessor, an independent auditor for PCI DSS compliance Cardholder data = Sensitive information related to payment cards Annual validation = Verification of compliance with PCI DSS standards

Cardholder's email address

Encrypt cardholder data at rest and in transit

Loss of processing privileges

To prevent fraud and protect cardholder data

Regularly testing and monitoring systems for vulnerabilities

False

True

Regularly testing and monitoring systems for vulnerabilities

All organizations that process, store, or transmit cardholder data

Protect cardholder data from unauthorized access, use, or disclosure

Use weak passwords and security controls

To identify and mitigate potential security vulnerabilities

Biometric authentication

Encrypt cardholder data at rest and in transit

To validate compliance with PCI DSS

All of the above

Self-assessment

All of the above

To protect cardholder data and prevent fraud

Test and monitor systems and networks regularly

True

True

False

False

False

True

False

False

True

False

False

True

False

False

False

False

False

True

True

False