Which of the following is a key requirement of the Payment Card Industry Data Security Standard (PCI DSS) for organizations that store cardholder data?

Encrypting cardholder data when transmitted over open, public networks.

Conducting vulnerability scans annually to identify potential security weaknesses.

Storing the full magnetic stripe data of payment cards to facilitate faster transactions.

Allowing all employees to access cardholder data to improve operational efficiency.

A company is required by law to keep financial transaction records for seven years. After that period, the data should be securely deleted. Which policy should the company implement to ensure this happens consistently?

A data retention policy that specifies the retention period and the secure disposal method.

A data classification policy that labels data as public, internal, or confidential.

A data access policy that defines which users can view financial records.

A data backup policy that ensures daily backups are taken and stored offsite.

What is the primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?

To provide a certification for credit card processing software.

To regulate the interest rates that financial institutions can charge on credit cards.

To secure cardholder data and maintain payment security.

To standardize the format of credit card numbers across different issuers.

A small business processes credit card payments and stores cardholder data in a database. To comply with PCI DSS, which of the following is a required control?

Encrypt all cardholder data in the database.

Implement multi-factor authentication for all database access.

Conduct annual penetration testing.

Use a firewall to protect the cardholder data environment.

A company has a database that contains personal data of EU citizens. The company wants to implement a DLP strategy that complies with GDPR. Which measure is most aligned with GDPR's data minimization principle?

Collect only the personal data that is necessary for the specific purpose.

Retain personal data for as long as possible for future use.

Encrypt all personal data in the database.

Implement role-based access control to limit who can access personal data.

CompTIADataSys+

Domain 4Objective 2

Governance and Compliance DS0-001 Practice Questions (Page 1)

Part of the Data and database security domain, which accounts for 23% of the DS0-001 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

23%of the exam

Questions 1–5

1foundation · easy
Which of the following is a key requirement of the Payment Card Industry Data Security Standard (PCI DSS) for organizations that store cardholder data?
Select an answer first
2foundation · easy
A company is required by law to keep financial transaction records for seven years. After that period, the data should be securely deleted. Which policy should the company implement to ensure this happens consistently?
Select an answer first
3foundation · easy
What is the primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?
Select an answer first
4application · medium
A small business processes credit card payments and stores cardholder data in a database. To comply with PCI DSS, which of the following is a required control?
Select an answer first
5expert · hard
A company has a database that contains personal data of EU citizens. The company wants to implement a DLP strategy that complies with GDPR. Which measure is most aligned with GDPR's data minimization principle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DS0-001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “DS0-001” is a trademark of its owner, used for identification only.