問55
頻出度★★★
情報セキュリティにおけるPCI DSS の説明として, 適切なものはどれか。
令和4年度 ITパスポート試験 問55
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 55
- ア
正解 PCI DSS stands for “Payment Card Industry Data Security Standard”. It is a security standard jointly established by the major international credit card brands for safely handling cardholder data and transaction information. It requires merchants and payment service providers that store, process, or transmit information such as card numbers to meet requirements such as network protection, data encryption, access control, and monitoring. Therefore, choice ア, which describes it as “a security standard required for businesses that handle credit card information”, is correct.
Incorrectイ
“A semiconductor chip built into computers and similar devices that performs security-related processing” describes the TPM (Trusted Platform Module), which handles tasks such as generating and storing encryption keys, not PCI DSS.
Incorrectウ
“An organization that responds to security incidents involving computers and networks” describes a CSIRT (Computer Security Incident Response Team); it refers to a response team rather than a standard, so it is not PCI DSS.
Incorrectエ
“A system that monitors communications on servers and networks, detects unauthorized access, and defends against attacks” describes an IPS (Intrusion Prevention System), not PCI DSS, which is a security standard.
ここがポイント
- PCI DSS is an industry-standard security standard imposed on businesses that handle credit card cardholder data.
- Distinguishing it from confusable terms: TPM (a security chip), CSIRT (an incident-response team), and IPS (an intrusion prevention system) are none of them standards, and each refers to something different.
用語