nerdexam
GIAC

GCFA · Question #66

You work as a Network Administrator for Web World Inc. You want to host an e-commerce Web site on your network. You want to ensure that storage of credit card information is secure. Which of the…

The correct answer is B. Strong encryption software should be used to store credit card information. C. Only authorized access should be allowed to credit card information. Securing stored credit card data requires strong encryption of the data itself and strict access controls limiting who can retrieve it, in line with PCI-DSS requirements.

Advanced Incident Response & Digital Forensics Fundamentals

Question

You work as a Network Administrator for Web World Inc. You want to host an e-commerce Web site on your network. You want to ensure that storage of credit card information is secure. Which of the following conditions should be met to accomplish this? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ANT authentication should be required for all customers before they provide their credit card numbers.
  • BStrong encryption software should be used to store credit card information.
  • COnly authorized access should be allowed to credit card information.
  • DThe NTFS file system should be implemented on a client computer.

How the community answered

(34 responses)
  • A
    15% (5)
  • B
    79% (27)
  • D
    6% (2)

Why each option

Securing stored credit card data requires strong encryption of the data itself and strict access controls limiting who can retrieve it, in line with PCI-DSS requirements.

ANT authentication should be required for all customers before they provide their credit card numbers.

Requiring NT authentication for customers before collecting card numbers is not a recognized PCI-DSS control for protecting stored cardholder data and does not address how data is secured after storage.

BStrong encryption software should be used to store credit card information.Correct

PCI-DSS Requirement 3 mandates that stored cardholder data be protected using strong cryptography, making encryption of credit card information a non-negotiable baseline for compliance.

COnly authorized access should be allowed to credit card information.Correct

PCI-DSS Requirement 7 specifies that access to cardholder data must be restricted to only those individuals whose job requires it, enforcing a need-to-know access control model.

DThe NTFS file system should be implemented on a client computer.

Implementing NTFS on a client computer does not secure credit card data stored on a server; client-side filesystem choice has no bearing on server-side data protection.

Concept tested: PCI-DSS requirements for credit card data protection

Source: https://www.pcisecuritystandards.org/document_library/

Topics

#credit card security#encryption#access control#data protection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice