PCI DSS Requirements & Implementation Flashcards
7 cards from real PCI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 PCI DSS Requirements & Implementation flashcards as text
How often must security awareness training be provided to all personnel under Requirement 12.6.1/12.6.2?
Answer: Upon hire and at least once every 12 months
Personnel must complete awareness training upon hire and at least annually thereafter, and the program content is reviewed annually.
How often must the scope of PCI DSS be documented and confirmed by the entity under Requirement 12.5.2?
Answer: At least once every 12 months and upon significant change
Requirement 12.5.2 requires scope to be documented and confirmed at least every 12 months and upon significant changes.
How often must service providers test segmentation controls under Requirement 11.4.6?
Answer: Every six months and after changes
Service providers using segmentation must test segmentation controls at least every six months and after changes, versus annually for other entities.
What does Requirement 12.8 require when sharing account data with third-party service providers (TPSPs)?
Answer: A list of TPSPs, written agreements acknowledging responsibility, due diligence, and monitoring of their PCI DSS compliance status
Requirement 12.8 mandates a TPSP inventory, written agreements, due diligence before engagement, compliance monitoring annually, and responsibility matrix.
Which component is required in the incident response plan per Requirement 12.10.1?
Answer: Roles, communication strategies, containment, recovery and business recovery procedures, plus reference to card brand requirements
The IR plan must define roles, communication and contact strategies including notification of payment brands and acquirers, and containment/recovery steps.
How long must visitor logs recording physical access to the CDE be retained under Requirement 9.3.4?
Answer: At least three months
Requirement 9.3.4 requires visitor logs to be retained for at least three months unless restricted by law.
How often must POI devices be periodically inspected for tampering under Requirement 9.5.1.2?
Answer: Defined by the entity's targeted risk analysis
Requirement 9.5.1.2 sets inspection frequency based on the entity's targeted risk analysis (12.3.1).
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- pcisecuritystandards.org — Test delivery, eligibility, fees, exam format, passing score, renewal, retake fee, retake policy, score release, test dates · verified Oct 2026
- pearsonvue.com — Test delivery · verified Oct 2026