PCI Professional Development Flashcards

Which statement about compensating controls is correct?

Answer: They must meet the intent and rigor of the original requirement and go above and beyond other requirements

Compensating controls must satisfy the intent and rigor of the requirement and be documented and validated by the assessor.

What must an entity maintain regarding third-party service providers (TPSPs) under Requirement 12.8?

Answer: Information about which PCI DSS requirements are managed by each TPSP and which by the entity

Req 12.8.5 requires tracking which requirements are managed by each TPSP, the entity, or shared.

A suspected cardholder data breach is discovered. What is the most appropriate early action?

Answer: Activate the incident response plan, preserve evidence, and notify the acquirer/payment brands as required

The IR plan must be activated, evidence preserved, and required parties such as the acquirer notified.

When PAN is displayed, what is the maximum that may be shown under Requirement 3.4.1?

Answer: First 6 and last 4 digits (or BIN and last 4)

Displayed PAN must be masked so only the BIN (up to first eight digits) and last four digits are shown at most, unless a business need is documented.

How often must security awareness training be provided to personnel?

Answer: At hire and at least once every 12 months

Req 12.6 requires awareness training upon hire and at least every 12 months.

How often must penetration testing be performed under Requirement 11.4.1?

Answer: At least once every 12 months and after significant changes

Pen tests are required at least annually and after any significant infrastructure or application change.

How often must PCI DSS scope be documented and confirmed under Requirement 12.5.2?

Answer: At least once every 12 months and upon significant change

Scope must be confirmed at least every 12 months and after significant changes to the in-scope environment.