PCI Professional Development Flashcards

Is network segmentation required by PCI DSS?

Answer: No, but it can reduce the scope of the assessment

Segmentation is not a PCI DSS requirement but properly implemented it can reduce the CDE scope.

Which merchants are eligible for SAQ A?

Answer: Card-not-present merchants that fully outsource all cardholder data functions to validated third parties

SAQ A fits card-not-present merchants with no electronic storage, processing, or transmission of cardholder data on their systems.

Which SAQ applies to merchants using only a PCI-listed P2PE solution with no electronic cardholder data storage?

Answer: SAQ P2PE

SAQ P2PE is for merchants using only a PCI SSC-listed point-to-point encryption solution.

What is the purpose of the Attestation of Compliance (AOC)?

Answer: To declare the entity's PCI DSS assessment results and compliance status

The AOC is the form where the entity (and assessor) attest to the results of the assessment.

Which systems are considered in scope for PCI DSS?

Answer: System components in or connected to the CDE, plus those that could impact its security

Scope includes the CDE, systems connected to it, and security-impacting systems.

Who decides whether a merchant must validate compliance and at what level?

Answer: The acquirer and payment brands

The PCI SSC does not enforce compliance; acquirers and payment brands set validation and reporting requirements.

What validation is typically required for a Level 1 merchant?

Answer: An annual Report on Compliance by a QSA or qualified internal assessor

Level 1 merchants generally need an annual ROC by a QSA or ISA, an AOC, and quarterly ASV scans where applicable.