APRP APRP Quality & Compliance 2

Question 1

Under PCI DSS, what is the maximum period allowed between required internal vulnerability scans?

Accepted Answer

90 days

Answer

PCI DSS requires internal vulnerability scans to be performed at least quarterly (every 90 days).

Question 2

A merchant's chargeback rate exceeds the card network's threshold for two consecutive months. What program does this typically trigger?

Accepted Answer

Chargeback Monitoring Program

Answer

Card networks place merchants whose chargeback rates exceed defined thresholds into a Chargeback Monitoring Program, which imposes fees and remediation requirements.

Question 3

Which BSA/AML control requires financial institutions to identify and verify the identity of beneficial owners of legal entity customers?

Accepted Answer

Customer Due Diligence (CDD) Rule

Answer

FinCEN's CDD Rule requires covered institutions to collect and verify beneficial ownership information for legal entity customers.

Question 4

A quality assurance review finds that a payments processor is approving transactions without verifying CVV2 for card-not-present purchases. Which compliance domain is most directly violated?

Accepted Answer

PCI DSS Requirement 3

Answer

PCI DSS Requirement 3 governs the protection of stored cardholder data, including restrictions on storing sensitive authentication data such as CVV2 after authorization.

Question 5

What does a 'Risk-Based Approach' to AML compliance mean in practice?

Accepted Answer

Allocating more compliance resources to higher-risk customers and transactions

Answer

A risk-based approach concentrates AML resources and enhanced due diligence on customers and transactions assessed as higher risk.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP APRP Quality & Compliance 2