easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A small business owner stores customer payment…
A small business owner stores customer payment card information (PCI) in a legacy database that is not compliant with PCI DSS. The business is migrating to a new cloud-based point-of-sale (POS) system that uses tokenization. The owner wants to ensure that the legacy data is handled securely during the transition. Which of the following is the BEST approach?
⚠ Common exam trap
Many candidates choose encryption (Option B) as a 'secure' catch-all, but PCI DSS requires minimizing stored cardholder data, not just protecting it—tokenization with purging is the only option that eliminates the data entirely, which is the core principle of asset security and data minimization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tokenize the payment data in the legacy database, then securely purge the original cardholder data and verify the purge
Tokenization replaces sensitive cardholder data with a non-sensitive token, rendering the original data useless for attackers. After tokenizing the legacy database, securely purging the original cardholder data (e.g., using NIST SP 800-88 compliant methods like overwriting or degaussing) and verifying the purge ensures compliance with PCI DSS requirement 3.1 (minimize stored cardholder data) and eliminates the risk of data breach from the legacy system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Migrate the legacy data into the new POS system and have the tokenization service replace it
Why it's wrong here
Migrating sensitive payment card information (PCI) into a new Point-of-Sale (POS) system *before* tokenization exposes the data during transit and while it temporarily resides in the new system. This expands the attack surface and the window of vulnerability, increasing the risk of compromise before the tokenization service can replace the actual cardholder data. It fails to minimize the exposure of sensitive data within the organization's environment.
- ✗
Encrypt the legacy database using AES-256 and store the encryption key on a separate server
Why it's wrong here
While AES-256 encryption is a strong control for data at rest, this option merely encrypts the sensitive payment card data, meaning the data itself still exists within the organization's control. The organization remains fully within PCI DSS scope for storing cardholder data, and an attacker who compromises both the encrypted database and the separate key server could still decrypt the information. This approach protects confidentiality but does not eliminate the presence or inherent risk of possessing the sensitive data.
- ✗
Archive the legacy database to a tape backup and store it in a secure offsite vault
Why it's wrong here
Archiving the legacy database to tape, even when stored in a secure offsite vault, does not eliminate the organization's responsibility for the sensitive payment card data. The data remains within the organization's custody, meaning it is still subject to PCI DSS compliance requirements and associated risks. A physical breach of the vault, or compromise during data transit or retrieval, could still expose the cardholder data, as the data's existence is merely relocated, not removed.
- ✓
Tokenize the payment data in the legacy database, then securely purge the original cardholder data and verify the purge
Why this is correct
This is the most effective strategy for reducing PCI DSS scope and inherent risk. Tokenization replaces actual sensitive payment card information with non-sensitive, algorithmically generated tokens, which are then stored. Crucially, the subsequent secure purging and verification of the original cardholder data completely eliminates the sensitive information from the organization's systems, significantly reducing the attack surface and compliance burden.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
PCI DSS
The Payment Card Industry Data Security Standard is a set of security requirements designed to protect credit card data during storage, processing, and transmission.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.