CISSP Security and Risk Management Practice Question
A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)
⚠ Common exam trap
CISSP often tests the misconception that PCI DSS requires MFA for all employees or a specific approved-algorithm list, when in fact MFA is scoped to CDE access and encryption requirements are intent-based rather than a fixed algorithm catalog.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt transmission of cardholder data across open, public networks
Option C is correct because PCI DSS Requirement 4 mandates protecting cardholder data with strong cryptography during transmission over open, public networks such as the internet. Option D is correct because PCI DSS Requirement 9 requires restricting physical access to cardholder data and systems that store, process, or transmit it. Option E is correct because PCI DSS Requirement 1 requires installing and maintaining firewall and router configurations to protect cardholder data, including controlling traffic between trusted and untrusted networks. Option A is not a standalone PCI DSS requirement as phrased, since the standard addresses encryption of stored data under Requirement 3 but does not simply state 'use only approved encryption algorithms' as a requirement. Option B is not a PCI DSS requirement for all employees; MFA is required for remote access and certain non-console administrative access, not universally for every employee.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use only approved encryption algorithms for stored data
Why it's wrong here
While using approved encryption algorithms is a critical control, it is a specific detail within PCI DSS Requirement 3, which broadly mandates protecting stored cardholder data. Requirement 3.4 specifies rendering the Primary Account Number (PAN) unreadable, and 3.5 covers cryptographic key management. This option describes a component of a requirement, not one of the 12 high-level requirements themselves.
- ✗
Implement multi-factor authentication for all employees
Why it's wrong here
PCI DSS Requirement 8 focuses on identifying and authenticating access to system components. While Requirement 8.3 mandates multi-factor authentication (MFA) for all non-console administrative access to the Cardholder Data Environment (CDE) and all remote network access to the CDE, it does not broadly mandate MFA for *all employees* for *all access*. This option overstates the scope and is a specific control within Requirement 8, rather than a standalone high-level requirement.
- ✓
Encrypt transmission of cardholder data across open, public networks
Why this is correct
This option directly corresponds to PCI DSS Requirement 4: 'Encrypt transmission of cardholder data across open, public networks.' This foundational requirement mandates the use of strong cryptography and security protocols, such as TLS 1.2 or higher, to protect cardholder data during transit over untrusted networks, preventing interception and unauthorized disclosure. It is one of the 12 high-level requirements.
- ✓
Restrict physical access to cardholder data
Why this is correct
This aligns with PCI DSS Requirement 9: 'Restrict physical access to cardholder data.' This critical requirement focuses on implementing robust physical security measures, including access controls (e.g., badges, biometrics), surveillance, and visitor logs, to protect facilities and media containing cardholder data from unauthorized physical access, tampering, or theft. It is one of the 12 high-level requirements.
- ✓
Install and maintain a firewall configuration to protect cardholder data
Why this is correct
This is a direct match for PCI DSS Requirement 1: 'Install and maintain a firewall configuration to protect cardholder data.' This foundational requirement mandates the establishment and maintenance of network segmentation and access control rules via firewalls to create a secure boundary around the Cardholder Data Environment (CDE), preventing unauthorized network access and ensuring only necessary traffic flows. It is one of the 12 high-level requirements.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.