PCI CFA study guide
PCI CFA · Work through your exam, one topic at a time.
The PCI Forensic Analyst (often written CFA, and not to be confused with the chartered financial analyst designation) is a specialist credential for investigators who examine payment-card breaches. A PFI company is engaged by an acquirer or card brand when cardholder data is suspected of compromise, and the analysts who do the hands-on work must be able to trace an intrusion across a merchant or service provider environment, preserve evidence defensibly, and produce a report that stands up to review by the card brands. The PCI CFA study guide has 7 sections and about 2,022 words.
01PCI DSS Requirements and Scope
This domain checks whether you can bound a cardholder data environment (CDE) and map PCI DSS requirements to evidence. The exam favors scenarios where the stated diagram is incomplete and you must infer connected-to and security-impacting systems.
310 words, about 2 min02Forensic Investigation Methodology and Evidence Handling
Forensic methodology and evidence handling: can you preserve volatile and nonvolatile evidence, document it, and explain why an action is sound? Expect questions on order of volatility, imaging, hashing, chain of custody, and live response.
279 words, about 1 min03Cardholder Data Environment Analysis and Compromise Assessment
CDE analysis and compromise assessment: can you find where card data lives and flows, then decide whether an attacker could have accessed it? The exam tests data-flow mapping, PAN discovery, memory analysis, and scope expansion beyond infected hosts.
316 words, about 2 min04Malware Analysis and Attacker Tradecraft
Malware analysis and attacker tradecraft: static versus dynamic analysis, POS and web skimming, persistence, lateral movement, credential theft, exfiltration, and anti-forensics. You must infer behavior from artifacts without contaminating evidence.
271 words, about 1 min05Network and System Log Analysis
Network and system log analysis: source selection, retention, time sync, event-level interpretation, and correlation. The exam expects you to spot authentication bursts, new services, log gaps, and exfiltration patterns.
278 words, about 1 min06Reporting, Documentation, and PCI Forensic Investigator (PFI) Procedures
Reporting, documentation, and PFI procedures: the PFI role, engagement rules, report content, independence, evidence retention, and communication with acquirers and PCI SSC. A PCI Forensic Investigator is engaged when a suspected cardholder data compromise is reported, typically by the acquirer or processor.
280 words, about 1 min07Incident Response and Containment
Incident response and containment: the IR lifecycle, evidence-preserving containment, notification, eradication, recovery, and lessons learned, tied to PCI DSS Requirement 12.10. Phases: preparation, identification, containment, eradication, recovery, lessons learned.
288 words, about 1 min