PCI Professional Development Flashcards

Under PCI DSS v4.0, which access must be protected with multi-factor authentication?

Answer: All access into the cardholder data environment

Requirement 8.4.2 requires MFA for all access into the CDE, not just remote or administrative access.

What does PCI DSS v4.0 Requirement 6.4.3 require for scripts loaded on payment pages?

Answer: Scripts must be inventoried, justified, and authorized with integrity assurance

Req 6.4.3 requires each payment page script to be authorized, assured for integrity, and inventoried with a business justification.

What is the minimum password length required by PCI DSS v4.0 where the system supports it?

Answer: 12 characters

Requirement 8.3.6 raised the minimum length to 12 characters (8 only if the system does not support 12).

How often must internal vulnerability scans be performed under PCI DSS v4.0 Requirement 11.3.1?

Answer: At least once every three months

Internal vulnerability scans are required at least once every three months, with rescans until high-risk issues are resolved.

What is the audit log retention requirement in PCI DSS Requirement 10.5.1?

Answer: 12 months with the most recent 3 months immediately available

Audit log history must be kept at least 12 months, with at least the last three months immediately available for analysis.

Which statement about the customized approach in PCI DSS v4.0 is correct?

Answer: It is only available to entities that undergo a ROC assessment

The customized approach is not available to SAQ users and requires documented controls and a targeted risk analysis validated by an assessor.

After a transaction is authorized, what may a merchant do with sensitive authentication data (SAD)?

Answer: Not store it, even if encrypted

Requirement 3.3.1 prohibits retaining SAD after authorization even when encrypted (with limited issuer exceptions).