PCI DSS Requirements & Implementation Flashcards

How frequently must external vulnerability scans be performed by a PCI SSC Approved Scanning Vendor (ASV)?

Answer: At least once every three months

Requirement 11.3.2 requires external scans at least once every three months by an ASV, with passing results.

A system has been locked out after repeated failed logins. Under Requirement 8.3.4, what is the maximum number of invalid attempts before lockout?

Answer: 10

Requirement 8.3.4 limits invalid authentication attempts to no more than 10 before lockout for a minimum of 30 minutes or until an administrator resets.

What is the required idle time after which a user session must require re-authentication under Requirement 8.2.8?

Answer: 15 minutes

Requirement 8.2.8 requires re-authentication when a session has been idle for more than 15 minutes.

Under Requirement 8.4.2, MFA must be implemented for which access?

Answer: All non-console access into the CDE

v4.0 extended MFA to all access into the cardholder data environment, not just administrators or remote users.

How often must penetration testing of internal and external networks be performed at minimum?

Answer: At least once every 12 months and after significant changes

Requirement 11.4.2 and 11.4.3 require internal and external penetration testing at least annually and after significant infrastructure or application changes.

What is the required frequency of reviewing network security control (firewall/router) rule sets under Requirement 1.2.7?

Answer: At least once every six months

Requirement 1.2.7 requires configurations of NSCs to be reviewed at least once every six months.

Which describes a defined approach vs customized approach in PCI DSS v4.x?

Answer: Defined approach follows the stated requirement; customized approach meets the stated objective with controls designed by the entity

The customized approach lets entities meet a requirement's objective with their own controls, validated through targeted risk analysis and assessor testing.