Leadership & Team Management Flashcards

A security lead wants to reduce PCI scope. Which approach is most effective when properly validated?

Answer: Network segmentation validated by penetration testing

Segmentation reduces scope and must be validated, with segmentation pen tests at least every 12 months.

Which principle supports separating pre-production and production environments and duties (Requirement 6.5)?

Answer: Separation of roles and functions

Requirement 6.5 requires separation of environments and of roles between them.

How often must user accounts and access privileges be reviewed under Requirement 7.2.4?

Answer: At least once every six months

User accounts and related access privileges are reviewed at least every six months.

A team member discovers full track data stored after authorization. What is the correct response?

Answer: Securely delete it and treat the finding as a compliance issue to investigate

Sensitive authentication data must not be stored after authorization, even if encrypted.

Who is ultimately responsible for an organization's PCI DSS compliance?

Answer: The entity's management

The entity owns compliance; QSAs only assess and validate.

Which tasks must incident response monitoring and response include per Requirement 12.10.5?

Answer: Alerts from security monitoring such as IDS/IPS and file-integrity monitoring

The plan must include responding to alerts from monitoring systems like IDS/IPS and FIM.

How often must information security policies be reviewed under Requirement 12.1.2?

Answer: At least once every 12 months, and updated as needed

Policies are reviewed at least annually and updated when the environment changes.