PCI PCI Professional Development 3

Question 1

Is network segmentation required by PCI DSS?

Accepted Answer

No, but it can reduce the scope of the assessment

Answer

Segmentation is not a PCI DSS requirement but properly implemented it can reduce the CDE scope.

Question 2

Which merchants are eligible for SAQ A?

Accepted Answer

Card-not-present merchants that fully outsource all cardholder data functions to validated third parties

Answer

SAQ A fits card-not-present merchants with no electronic storage, processing, or transmission of cardholder data on their systems.

Question 3

Which SAQ applies to merchants using only a PCI-listed P2PE solution with no electronic cardholder data storage?

Accepted Answer

SAQ P2PE

Answer

SAQ P2PE is for merchants using only a PCI SSC-listed point-to-point encryption solution.

Question 4

What is the purpose of the Attestation of Compliance (AOC)?

Accepted Answer

To declare the entity's PCI DSS assessment results and compliance status

Answer

The AOC is the form where the entity (and assessor) attest to the results of the assessment.

Question 5

Which systems are considered in scope for PCI DSS?

Accepted Answer

System components in or connected to the CDE, plus those that could impact its security

Answer

Scope includes the CDE, systems connected to it, and security-impacting systems.

PCI - Certified Payment Card Industry Specialist Practice Test