Examkin

Question

Difficulty: MediumRegulatory Compliance and Legal Requirements Management

A multinational fintech company processes both Payment Card Industry Data Security Standard (PCI DSS) regulated payment card data and user personally identifiable information (PII). The security team is updating its regulatory compliance posture. Which of the following actions represent mandatory compliance practices for managing these regulatory requirements? (Select TWO).

  1. Segmenting the network to isolate the Cardholder Data Environment (CDE) from systems that process general enterprise PIIAnswer
  2. Rendering primary account numbers (PAN) unreadable anywhere they are stored using strong cryptographic algorithms and proper key managementAnswer
  3. C
    Storing primary account numbers in plaintext within long-term relational database backups to simplify mandatory financial auditing procedures
  4. D
    Transferring full legal and regulatory liability for data privacy compliance to the cloud service provider under Infrastructure as a Service deployment models

Answer

The correct practices are isolating the Cardholder Data Environment (CDE) through network segmentation to limit audit scope, and rendering stored primary account numbers (PAN) unreadable using strong cryptography and key management.
Isolating the Cardholder Data Environment (CDE) via network segmentation reduces the audit boundary, and cryptographically protecting primary account numbers (PAN) ensures compliance with PCI DSS data protection rules.

Step-by-Step Solution

1
Analyze PCI DSS scope reduction strategies
Network segmentation isolates cardholder data processing systems, reducing the overall audit and compliance boundary.
Without segmentation, the entire enterprise network falls under PCI DSS compliance scope.
2
Evaluate data protection controls for cardholder data storage
Primary account numbers (PAN) must be protected using strong encryption, truncation, or tokenization.
PCI DSS mandates cryptographic protection for PAN to prevent unauthorized exposure.
3
Evaluate cloud governance and liability limitations
Cloud service agreements cannot transfer legal compliance obligations away from the data controller or organization.
The shared responsibility model assigns data governance and regulatory compliance responsibilities to the customer.

Key Concept

PCI DSS Compliance and Scope Management
Rate this question

Topics

Regulatory Compliance and Legal Requirements Management

More questions from this topic