PCI Access Control & Authentication

Question 1

What is the principle of least privilege in PCI compliance?

Accepted Answer

Granting users only the minimum access necessary to perform their job functions

Answer

Giving all employees full administrative access

Answer

Removing all access from employees during their first month

Answer

Only applying access restrictions to contractors, not employees

Question 2

What is multi-factor authentication (MFA) and when does PCI DSS require it?

Accepted Answer

Authentication using two or more independent factors, required for all remote network access and administrative access to the CDE

Answer

Using two passwords instead of one

Answer

Only required for customers making online purchases

Answer

A single biometric scan for all access

Question 3

What is role-based access control (RBAC)?

Accepted Answer

Assigning access permissions based on job roles rather than individual users, simplifying management and ensuring consistency

Answer

A security role-playing game for training purposes

Answer

A system where roles are based on seniority only

Answer

Access control based on employee personality types

Question 4

What are the PCI DSS requirements for password security?

Accepted Answer

Minimum 7 characters (12 recommended), complexity requirements, 90-day rotation, and prohibition of default passwords

Answer

Any password is acceptable under PCI DSS

Answer

Passwords must be changed daily

Answer

Only numeric PINs are acceptable

Question 5

How should access to cardholder data be monitored?

Accepted Answer

Through comprehensive logging of all access to cardholder data, reviewed regularly for unauthorized activity

Answer

Only monitor access when a breach is suspected

Answer

Monitoring is optional for organizations with fewer than 100 employees

Answer

Only physical access needs to be monitored

Question 6

What physical security controls does PCI DSS require?

Accepted Answer

Restricted physical access to cardholder data areas, visitor logs, media destruction procedures, and POS device inspection

Answer

Only a locked front door to the building

Answer

Physical security is not addressed in PCI DSS

Answer

Only security cameras at building entrances