PCI Leadership & Team Management 3

Question 1

When an entity chooses its own frequency for certain periodic tasks in PCI DSS v4.0, what must support that frequency?

Accepted Answer

A targeted risk analysis

Answer

Requirement 12.3.1 requires a documented targeted risk analysis to justify flexible frequencies.

Question 2

What must security awareness training include per Requirement 12.6.3.1?

Accepted Answer

Threats such as phishing and social engineering

Answer

Training must cover phishing and related attacks and social engineering.

Question 3

How often must service providers review that personnel are performing their security tasks (Requirement 12.4.2)?

Accepted Answer

At least once every three months

Answer

Service providers perform quarterly reviews to confirm tasks are performed per policy.

Question 4

How often must hardware and software technologies in use be reviewed to confirm they remain supported?

Accepted Answer

At least once every 12 months

Answer

Requirement 12.3.4 requires annual review of technologies, including vendor support status.

Question 5

What must a TPSP provide to its customers under Requirement 12.9.1?

Accepted Answer

A written acknowledgment of responsibility for account data security

Answer

TPSPs must acknowledge in writing their responsibility for the security of account data they handle.

PCI - Certified Payment Card Industry Specialist Practice Test