PCI DSS Compliance & Standards 3

Question 1

Under PCI DSS v4.0, how often must the scope of PCI DSS be documented and confirmed (Req. 12.5.2)?

Accepted Answer

At least once every 12 months and upon significant change

Answer

Scope must be documented and confirmed at least every 12 months and after significant change.

Question 2

When did the future-dated requirements of PCI DSS v4.0 become mandatory?

Accepted Answer

March 31, 2025

Answer

Future-dated v4.0 requirements became effective March 31, 2025, when v3.2.1 had already been retired.

Question 3

Which entities generally cannot use the customized approach when completing a Self-Assessment Questionnaire?

Accepted Answer

Entities completing an SAQ

Answer

The customized approach is not supported for SAQs; it requires a ROC-style assessment.

Question 4

PCI DSS v4.0 Requirement 6.4.3 requires what for scripts on payment pages loaded in the consumer's browser?

Accepted Answer

Scripts must be managed with authorization, integrity assurance, and an inventory with justification

Answer

Req. 6.4.3 requires each script be authorized, integrity-checked, and inventoried with business justification.

Question 5

Requirement 11.6.1 introduced in v4.0 addresses which risk?

Accepted Answer

Unauthorized changes to HTTP headers and payment page content via a change- and tamper-detection mechanism

Answer

11.6.1 requires detecting unauthorized modification of HTTP headers and payment page contents.

PCI - Certified Payment Card Industry Specialist Practice Test