CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use only approved encryption algorithms for stored data

  Why it's wrong here

  While using approved encryption algorithms is a critical control, it is a specific detail within PCI DSS Requirement 3, which broadly mandates protecting stored cardholder data. Requirement 3.4 specifies rendering the Primary Account Number (PAN) unreadable, and 3.5 covers cryptographic key management. This option describes a component of a requirement, not one of the 12 high-level requirements themselves.

• ✗

  Implement multi-factor authentication for all employees

  Why it's wrong here

  PCI DSS Requirement 8 focuses on identifying and authenticating access to system components. While Requirement 8.3 mandates multi-factor authentication (MFA) for all non-console administrative access to the Cardholder Data Environment (CDE) and all remote network access to the CDE, it does not broadly mandate MFA for *all employees* for *all access*. This option overstates the scope and is a specific control within Requirement 8, rather than a standalone high-level requirement.

• ✓

  Encrypt transmission of cardholder data across open, public networks

  Why this is correct

  This option directly corresponds to PCI DSS Requirement 4: 'Encrypt transmission of cardholder data across open, public networks.' This foundational requirement mandates the use of strong cryptography and security protocols, such as TLS 1.2 or higher, to protect cardholder data during transit over untrusted networks, preventing interception and unauthorized disclosure. It is one of the 12 high-level requirements.

• ✓

  Restrict physical access to cardholder data

  Why this is correct

  This aligns with PCI DSS Requirement 9: 'Restrict physical access to cardholder data.' This critical requirement focuses on implementing robust physical security measures, including access controls (e.g., badges, biometrics), surveillance, and visitor logs, to protect facilities and media containing cardholder data from unauthorized physical access, tampering, or theft. It is one of the 12 high-level requirements.

• ✓

  Install and maintain a firewall configuration to protect cardholder data

  Why this is correct

  This is a direct match for PCI DSS Requirement 1: 'Install and maintain a firewall configuration to protect cardholder data.' This foundational requirement mandates the establishment and maintenance of network segmentation and access control rules via firewalls to create a secure boundary around the Cardholder Data Environment (CDE), preventing unauthorized network access and ensuring only necessary traffic flows. It is one of the 12 high-level requirements.

Go deeper

Related to this question