PCI Access Control & Authentication

Question 1

What is the principle of least privilege in PCI compliance?

Accepted Answer

Granting users only the minimum access necessary to perform their job functions

Answer

The principle of least privilege ensures that users, processes, and systems have only the minimum access needed to perform their functions, reducing the risk of unauthorized access to cardholder data.

Question 2

What is multi-factor authentication (MFA) and when does PCI DSS require it?

Accepted Answer

Authentication using two or more independent factors, required for all remote network access and administrative access to the CDE

Answer

PCI DSS requires MFA for all remote access to the cardholder data environment and all administrative access, using at least two of three factors: something you know, have, or are.

Question 3

What is role-based access control (RBAC)?

Accepted Answer

Assigning access permissions based on job roles rather than individual users, simplifying management and ensuring consistency

Answer

RBAC assigns permissions to roles (e.g., 'payment processor,' 'database administrator') and then assigns users to roles, ensuring consistent, manageable access that aligns with job functions.

Question 4

What are the PCI DSS requirements for password security?

Accepted Answer

Minimum 7 characters (12 recommended), complexity requirements, 90-day rotation, and prohibition of default passwords

Answer

PCI DSS v4.0 recommends passwords of at least 12 characters with complexity, requires changing every 90 days, prohibits sharing, and mandates changing all vendor defaults before deployment.

Question 5

How should access to cardholder data be monitored?

Accepted Answer

Through comprehensive logging of all access to cardholder data, reviewed regularly for unauthorized activity

Answer

PCI DSS requires logging all access to network resources and cardholder data, with daily log review processes to identify anomalies, unauthorized access attempts, or suspicious activity.

PCI - Certified Payment Card Industry Specialist Practice Test

PCI - Certified Payment Card Industry Specialist Practice Test

PCI Access Control & Authentication