PCI Leadership & Team Management 4

Question 1

A security lead wants to reduce PCI scope. Which approach is most effective when properly validated?

Accepted Answer

Network segmentation validated by penetration testing

Answer

Segmentation reduces scope and must be validated, with segmentation pen tests at least every 12 months.

Question 2

Which principle supports separating pre-production and production environments and duties (Requirement 6.5)?

Accepted Answer

Separation of roles and functions

Answer

Requirement 6.5 requires separation of environments and of roles between them.

Question 3

How often must user accounts and access privileges be reviewed under Requirement 7.2.4?

Accepted Answer

At least once every six months

Answer

User accounts and related access privileges are reviewed at least every six months.

Question 4

A team member discovers full track data stored after authorization. What is the correct response?

Accepted Answer

Securely delete it and treat the finding as a compliance issue to investigate

Answer

Sensitive authentication data must not be stored after authorization, even if encrypted.

Question 5

Who is ultimately responsible for an organization's PCI DSS compliance?

Accepted Answer

The entity's management

Answer

The entity owns compliance; QSAs only assess and validate.

PCI - Certified Payment Card Industry Specialist Practice Test