Q5Fundamentals
A company has launched an e-commerce website with multiple points of sale through internal and external e-stores. Customers access the stores through the public website, while employees access them from the intranet using SSO. Which action is required to comply with PCI standards for system hardening?
← → navigate · a answer
Community votes
Discussion · 6
A 6
Selected Answer: A
A. Mask the PAN numbers
2
B. Encrypt personal data.
To comply with PCI standards for hardening the systems, personal data, including credit card information, must be encrypted. Masking PAN (Primary Account Number) numbers can reduce the risk of unauthorized access, but it is not sufficient to meet the standard. Encrypting access is also not enough because it does not address the requirement to encrypt sensitive data. Masking sales details can help protect sensitive information, but it is not enough to comply with the PCI standards for hardening systems. - ChatGPT
A 1
Selected Answer: A
A. Mask the PAN numbers
1
Card holder data (CHD) at rest should be masked
CHD while processing should be encrypted. I think this question is about access so it should be encryption.
https://blog.rsisecurity.com/comprehensive-guide-to-pci-dss-masking-requirements-for-cardholder-data/
B 1
Selected Answer: B
To comply with PCI standards for hardening systems, especially for an e-commerce website with multiple points of sale, it is necessary to encrypt personal data. This includes any information that can identify an individual, such as names, addresses, and credit card numbers. Encryption helps protect this data in transit and at rest, lowering the risk of unauthorized access and data breaches2.
C 1
Selected Answer: C
ChatGPT: To comply with PCI DSS standards for hardening systems, the needed action is to encrypt access (i.e., encrypt the communication channels used to transmit sensitive payment data). This makes sure payment card information is transmitted securely and protected from unauthorized access.