PCI Network Security & Architecture 3

Question 1

What does PCI DSS require regarding time synchronization for systems within the cardholder data environment?

Accepted Answer

All in-scope system components must use time synchronization technology

Answer

Time synchronization is optional but recommended for forensic investigations

Answer

Only servers storing PANs require synchronized system clocks

Answer

Time synchronization must be managed externally by the acquiring bank

Question 2

Which of the following best defines 'in-scope' systems for a PCI DSS network security assessment?

Accepted Answer

All system components that store, process, or transmit cardholder data, plus connected components that could impact their security

Answer

Only servers that store Primary Account Numbers (PANs)

Answer

Any server that has internet connectivity within the organization

Answer

Only payment terminals and point-of-sale devices

Question 3

How frequently does PCI DSS require file integrity monitoring (FIM) solutions to perform critical file comparisons on in-scope systems?

Accepted Answer

At least once every week

Answer

Daily

Answer

Monthly

Answer

Only upon detection of a change event

Question 4

What is the primary purpose of deploying an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) within the CDE under PCI DSS?

Accepted Answer

To monitor traffic at the perimeter and at critical internal points to detect and alert on suspicious activity

Answer

To replace firewall rules for inbound traffic management in the CDE

Answer

To manage access credentials for all network devices within scope

Answer

To generate and distribute encryption keys for network communications

Question 5

Which PCI DSS requirement addresses the protection of cardholder data during transmission over open, public networks?

Accepted Answer

Requirement 4 — Protection of Cardholder Data with Strong Cryptography During Transmission

Answer

Requirement 1 — Network Security Controls

Answer

Requirement 3 — Protection of Stored Account Data

Answer

Requirement 8 — Identification and Authentication Access to System Components

Question 6

When is external network penetration testing required under PCI DSS?

Accepted Answer

At least annually and after any significant infrastructure or application changes

Answer

Only after a confirmed security breach or suspected compromise

Answer

Every two years for Level 2 merchants and above

Answer

Penetration testing is not required under PCI DSS; only internal vulnerability scanning is mandatory

Question 7

According to PCI DSS, what are the retention requirements for security event logs generated by network security controls?

Accepted Answer

Logs must be retained for at least 12 months, with the most recent three months immediately available for analysis

Answer

Logs must be stored encrypted within the CDE for at least 90 days

Answer

Logs must be reviewed and approved by the acquiring bank monthly

Answer

Logs may be overwritten after 60 days if storage capacity is a constraint