PCI Access Control & Authentication — Questions and Answers
Question 1: What is the principle of least privilege in PCI compliance?
- Granting users only the minimum access necessary to perform their job functions (Correct answer)
- Giving all employees full administrative access
- Removing all access from employees during their first month
- Only applying access restrictions to contractors, not employees
Correct answer: Granting users only the minimum access necessary to perform their job functions
The principle of least privilege ensures that users, processes, and systems have only the minimum access needed to perform their functions, reducing the risk of unauthorized access to cardholder data.
Question 2: What is multi-factor authentication (MFA) and when does PCI DSS require it?
- Authentication using two or more independent factors, required for all remote network access and administrative access to the CDE (Correct answer)
- Using two passwords instead of one
- Only required for customers making online purchases
- A single biometric scan for all access
Correct answer: Authentication using two or more independent factors, required for all remote network access and administrative access to the CDE
PCI DSS requires MFA for all remote access to the cardholder data environment and all administrative access, using at least two of three factors: something you know, have, or are.
Question 3: What is role-based access control (RBAC)?
- Assigning access permissions based on job roles rather than individual users, simplifying management and ensuring consistency (Correct answer)
- A security role-playing game for training purposes
- A system where roles are based on seniority only
- Access control based on employee personality types
Correct answer: Assigning access permissions based on job roles rather than individual users, simplifying management and ensuring consistency
RBAC assigns permissions to roles (e.g., 'payment processor,' 'database administrator') and then assigns users to roles, ensuring consistent, manageable access that aligns with job functions.
Question 4: What are the PCI DSS requirements for password security?
- Minimum 7 characters (12 recommended), complexity requirements, 90-day rotation, and prohibition of default passwords (Correct answer)
- Any password is acceptable under PCI DSS
- Passwords must be changed daily
- Only numeric PINs are acceptable
Correct answer: Minimum 7 characters (12 recommended), complexity requirements, 90-day rotation, and prohibition of default passwords
PCI DSS v4.0 recommends passwords of at least 12 characters with complexity, requires changing every 90 days, prohibits sharing, and mandates changing all vendor defaults before deployment.
Question 5: How should access to cardholder data be monitored?
- Through comprehensive logging of all access to cardholder data, reviewed regularly for unauthorized activity (Correct answer)
- Only monitor access when a breach is suspected
- Monitoring is optional for organizations with fewer than 100 employees
- Only physical access needs to be monitored
Correct answer: Through comprehensive logging of all access to cardholder data, reviewed regularly for unauthorized activity
PCI DSS requires logging all access to network resources and cardholder data, with daily log review processes to identify anomalies, unauthorized access attempts, or suspicious activity.
Question 6: What physical security controls does PCI DSS require?
- Restricted physical access to cardholder data areas, visitor logs, media destruction procedures, and POS device inspection (Correct answer)
- Only a locked front door to the building
- Physical security is not addressed in PCI DSS
- Only security cameras at building entrances
Correct answer: Restricted physical access to cardholder data areas, visitor logs, media destruction procedures, and POS device inspection
PCI DSS requires physical access controls including badge readers, visitor management, surveillance, and secure storage for media containing cardholder data, with regular POS terminal inspection.
PCI Access Control & Authentication
What is the principle of least privilege in PCI compliance?