PCI CFA flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

A forensic principle ranking evidence by how quickly it disappears, from CPU registers and RAM down to archival media, guiding acquisition sequence so fragile evidence is captured first.

Chain of custody

A documented record tracking who collected evidence, when, where, and every transfer or access, ensuring evidence integrity and admissibility throughout the investigation lifecycle.

Write blocker

A hardware or software device that prevents any write operation to source media during acquisition, preserving original evidence and ensuring the forensic image matches the source bit-for-bit.

Forensic image hash

A cryptographic digest such as SHA-256 computed over source and image; matching values verify the copy is bit-for-bit identical and unaltered since acquisition.

MACB timestamps

Modified, accessed, changed, and birth times recorded by file systems; normalizing time zones and correlating these timestamps builds the investigative timeline.

Memory acquisition

Capturing volatile RAM before shutdown to preserve encryption keys, running malware, network connections, and credentials that do not exist on disk.

Cardholder data environment

The people, processes, and technology that store, process, or transmit cardholder data, plus any system that can impact the security of that environment.

CDE segmentation

Network isolation that separates cardholder data systems from other networks, reducing PCI scope only when verified by testing at least every twelve months.

PAN rendering unreadable

Requirement 3.4.1 mandate that stored primary account numbers be protected by truncation, hashing, tokenization, or strong cryptography wherever they are kept.

Audit trail retention

Requirement 10 rule that logs covering all access to cardholder data be retained at least twelve months, with the most recent three months immediately available for analysis.

SAQ A

Self-assessment questionnaire for merchants who fully outsource e-commerce payment processing, so cardholder data is never stored, processed, or transmitted on their systems.

Scope reduction

Eliminating cardholder data storage or isolating systems through segmentation so fewer systems fall within PCI DSS assessment boundaries, lowering compliance burden.

Data-flow mapping

Documenting where cardholder data enters, is stored, moves, and exits an environment; it defines CDE boundaries and identifies exfiltration points for investigation.

Memory scraper

Malware that reads payment application process memory to capture track data or PAN before encryption, a leading cause of POS compromises.

Card testing attack

Many low-value authorization attempts using stolen card numbers to validate them; detected by correlating merchant IDs, source IPs, and BIN ranges across logs.

Tokenization scope

Replacing PAN with tokens reduces CDE scope only when the tokenization system is isolated and tokens cannot be reversed without keys held inside the CDE.

Compromise scope determination

Identifying every system that could have accessed cardholder data, including systems without confirmed malware, to bound the breach accurately.

Track data storage

Full magnetic stripe data must never be retained after authorization; finding it in logs, memory, or databases is a significant PCI DSS violation.

Static malware analysis

Examining a binary without executing it, using strings, imports, PE headers, packing indicators, and embedded configuration to infer capabilities.

Dynamic malware analysis

Executing malware in an isolated sandbox while capturing process, file, registry, and network behavior to understand its runtime actions.

Reflective DLL injection

A technique loading a DLL directly into process memory without touching disk, commonly used by memory scrapers to evade file-based detection.

Beaconing

Regular, repeating outbound connections from an infected host to command-and-control infrastructure; interval analysis and jitter detection reveal it.

Domain generation algorithm

Malware generates many pseudo-random domain names for command and control, so blocking individual domains is ineffective; behavioral detection is required.

LSASS credential theft

Attackers access lsass.exe memory to extract password hashes and tickets; detection focuses on unusual process access to that system process.

Double extortion

Ransomware tradecraft where data is exfiltrated before encryption and threatened with release, making exfiltration a reportable compromise event.

Five-tuple correlation

Matching log events by source IP, destination IP, source port, destination port, and protocol to reconstruct connections across firewall, IDS, and host logs.

Event ID 4624

Windows Security log event recording a successful logon; analyzing logon type, account, and source host reveals unauthorized access.

Event ID 1102

Windows event recording that the audit log was cleared; its presence often indicates attacker anti-forensics and should trigger investigation.

Log integrity controls

Centralized collection, NTP synchronization, and tamper protection ensure logs are complete and trustworthy; missing or altered logs are findings.

PFI report contents

A PCI forensic investigator report states scope, methodology, evidence reviewed, confirmed findings, root cause, and the date of first evidence of compromise.

Incident containment

Limiting spread of a compromise while preserving evidence, often by network isolation rather than immediate wiping, with rationale documented.