Examkin

Question

Difficulty: MediumData Privacy and Compliance Regulations

An IT technician is updating data retention policies for a retail company's customer service call recording system. Audio logs frequently capture customers reciting their credit card numbers and three-digit security codes to agents during purchase verification. Which technical control must the technician mandate to align with PCI-DSS compliance requirements?

  1. Prevent the storage of sensitive authentication data, such as card security codes, after transaction authorization.Answer
  2. B
    Encrypt stored card security codes using strong AES-256 encryption for long-term audit retention.
  3. C
    Classify the call recordings as Protected Health Information (PHI) and restrict access to compliance officers.
  4. D
    Obtain written user consent under GDPR to store unmasked primary account numbers in clear text.

Answer

Prevent the storage of sensitive authentication data, such as card security codes, after transaction authorization.
Under PCI-DSS regulations, sensitive authentication data (SAD)—which includes card validation codes (CVV/CVC), personal identification numbers (PINs), and full magnetic stripe track data—must never be stored after transaction authorization, even if encrypted.

Step-by-Step Solution

1
Identify the relevant regulatory framework for credit card data.
Payment Card Industry Data Security Standard (PCI-DSS) governs the handling, storage, and transmission of cardholder data and sensitive authentication data.
The scenario specifically deals with credit card transaction numbers and CVV security codes.
2
Analyze PCI-DSS restrictions on sensitive authentication data (SAD).
PCI-DSS Requirement 3 explicitly prohibits storing SAD (including CVV/CVC codes and magnetic stripe data) after authorization.
Eliminating stored authentication data minimizes fraud risk in the event of a system compromise.

Key Concept

PCI-DSS restrictions on sensitive authentication data (SAD) storage.
Rate this question

Topics

Data Privacy and Compliance Regulations

More questions from this topic