PCI DSS Requirements & Implementation Flashcards

Which requirement addresses protecting payment page scripts, including maintaining an inventory and authorization of each script?

Answer: Requirement 6.4.3

Requirement 6.4.3 requires scripts loaded and executed in the consumer's browser on payment pages to be authorized, integrity-assured and inventoried.

Which requirement mandates a change- and tamper-detection mechanism for HTTP headers and payment page contents as received by the consumer browser?

Answer: Requirement 11.6.1

Requirement 11.6.1 requires a mechanism to alert on unauthorized modification to payment pages, evaluated at least weekly or per risk analysis.

A critical-risk security patch is released for an in-scope system. What is the maximum time to install it under Requirement 6.3.3?

Answer: Within one month of release

Requirement 6.3.3 requires critical or high-security patches to be installed within one month of release.

Which statement about using live PANs in pre-production environments is correct under Requirement 6.5.5?

Answer: Not used in pre-production environments, except where those environments are included in the CDE and protected per all applicable requirements

Live PANs may not be used in pre-production unless that environment is treated as part of the CDE and protected accordingly.

Which technique is acceptable for rendering PAN unreadable wherever it is stored under Requirement 3.5.1?

Answer: Strong cryptography with associated key management, truncation, or index tokens

Requirement 3.5.1 allows one-way keyed cryptographic hashes, truncation, index tokens, or strong cryptography with key management.

Under Requirement 3.5.1.1, what must hashes used to render PAN unreadable be?

Answer: Keyed cryptographic hashes of the entire PAN with associated key management

Requirement 3.5.1.1 requires keyed cryptographic hashes of the entire PAN, replacing the older unkeyed hash approach.

Which key management practice does Requirement 3.6/3.7 emphasize for manual cleartext cryptographic key operations?

Answer: Split knowledge and dual control

Manual cleartext key-management operations must use split knowledge and dual control so no single person has the whole key.