CREST Practitioner Security Analyst (CPSA) Practice

In a PCI Card Info storage system, what should be used to link cardholder and card details?

1. Customer ID only

2. A unique reference identifier

3. A shared password

4. Item number

The correct answer is: A unique reference identifier

Using a unique reference identifier to link cardholder data and card details in a PCI Card Info storage system is essential for maintaining the integrity and security of sensitive information. This approach ensures that each transaction or set of cardholder data can be distinctly identified without exposing personally identifiable information (PII) or card details themselves. A unique reference identifier is a non-intrusive and secure way to correlate a cardholder with their card information, facilitating transactions while adhering to compliance regulations. It minimizes the risk of data breaches as this identifier can be designed to be random or encoded, preventing unauthorized access and linking that could expose sensitive data. Other options, such as a customer ID, shared password, or item number, do not provide the same level of security and may lead to complications. A customer ID might be predictable and vulnerable to attacks, a shared password presents significant risks as it can be easily compromised, and an item number doesn’t necessarily serve as a secure link between sensitive information sets. Therefore, using a unique reference identifier aligns with best practices for data security and compliance within PCI standards.