Learn About the Processes and Controls Involved in Data and Platform Security. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–21

1. 21application · medium

   A retail company processes credit card transactions and stores customer data in a database. The security team is implementing controls to meet PCI DSS requirements. They need to protect cardholder data at rest and ensure that only authorized personnel can access the database. Which set of controls is most appropriate?

   • AApply network segmentation to isolate the database, and disable all remote access to the server.
   • BTokenize cardholder data, and restrict database access to a single administrator account.
   • CEncrypt the database files, implement role-based access control, and enable detailed audit logging for all access to cardholder data.
   • DUse a data loss prevention tool to monitor outbound traffic, and encrypt backups only.
   Reveal Solution Discussion Select an answer first