PCI DSS Compliance & Standards 4

Question 1

According to Req. 3.3.1, what must happen to sensitive authentication data (SAD) after authorization?

Accepted Answer

It must not be retained, even if encrypted

Answer

SAD, including full track data, CVV2, and PIN blocks, must not be stored after authorization.

Question 2

When PAN is displayed, what is the maximum that may be shown under Req. 3.4.1 for a business need?

Accepted Answer

The BIN and the last four digits

Answer

Displayed PAN must be masked so at most the BIN and last four digits are visible.

Question 3

Requirement 4.2.1 requires which protection for PAN transmitted over open, public networks?

Accepted Answer

Strong cryptography and security protocols

Answer

Strong cryptography and trusted keys/certificates must protect PAN in transit over open public networks.

Question 4

What is the minimum audit log retention under Req. 10.5.1?

Accepted Answer

12 months, with the most recent 3 months immediately available

Answer

Retain audit log history for at least 12 months, with the latest three months immediately available.

Question 5

How often must internal vulnerability scans be performed under Req. 11.3.1?

Accepted Answer

At least once every three months

Answer

Internal scans are required at least once every three months and after significant change rescans as needed.

PCI - Certified Payment Card Industry Specialist Practice Test