PCI PCI Professional Development 2

Question 1

Under PCI DSS v4.0, which access must be protected with multi-factor authentication?

Accepted Answer

All access into the cardholder data environment

Answer

Requirement 8.4.2 requires MFA for all access into the CDE, not just remote or administrative access.

Question 2

What does PCI DSS v4.0 Requirement 6.4.3 require for scripts loaded on payment pages?

Accepted Answer

Scripts must be inventoried, justified, and authorized with integrity assurance

Answer

Req 6.4.3 requires each payment page script to be authorized, assured for integrity, and inventoried with a business justification.

Question 3

What is the minimum password length required by PCI DSS v4.0 where the system supports it?

Accepted Answer

12 characters

Answer

Requirement 8.3.6 raised the minimum length to 12 characters (8 only if the system does not support 12).

Question 4

How often must internal vulnerability scans be performed under PCI DSS v4.0 Requirement 11.3.1?

Accepted Answer

At least once every three months

Answer

Internal vulnerability scans are required at least once every three months, with rescans until high-risk issues are resolved.

Question 5

What is the audit log retention requirement in PCI DSS Requirement 10.5.1?

Accepted Answer

12 months with the most recent 3 months immediately available

Answer

Audit log history must be kept at least 12 months, with at least the last three months immediately available for analysis.

PCI - Certified Payment Card Industry Specialist Practice Test