PCI DSS Compliance & Standards 5

Question 1

Which statement about ASV scans is correct?

Accepted Answer

A passing scan has no vulnerabilities rated CVSS 4.0 or higher

Answer

A passing ASV scan requires no vulnerabilities scored 4.0 or higher on the CVSS scale.

Question 2

What is the PCI Security Standards Council's role in compliance?

Accepted Answer

It develops and manages standards but does not enforce compliance

Answer

The PCI SSC maintains the standards; enforcement is by payment brands and acquirers.

Question 3

Who typically enforces PCI DSS compliance and levies non-compliance penalties on merchants?

Accepted Answer

Acquirers and payment brands

Answer

Payment brands and acquiring banks set validation requirements and penalties.

Question 4

Which program replaced PA-DSS for payment software?

Accepted Answer

PCI Software Security Framework

Answer

The PCI Software Security Framework (Secure Software and Secure SLC standards) superseded PA-DSS.

Question 5

What do Requirements 12.8.5 and 12.9.2 address regarding third-party service providers (TPSPs)?

Accepted Answer

Documenting which PCI DSS requirements are managed by each party, with shared responsibility information

Answer

Entities and TPSPs must clarify which requirements each manages and share responsibility information.

PCI - Certified Payment Card Industry Specialist Practice Test