PCI Network Security & Architecture 3

Question 1

What does PCI DSS require regarding time synchronization for systems within the cardholder data environment?

Accepted Answer

All in-scope system components must use time synchronization technology

Answer

PCI DSS Requirement 10 mandates time synchronization across all in-scope system components so that log timestamps are consistent and reliable for forensic and audit purposes.

Question 2

Which of the following best defines 'in-scope' systems for a PCI DSS network security assessment?

Accepted Answer

All system components that store, process, or transmit cardholder data, plus connected components that could impact their security

Answer

PCI DSS scope includes all system components that store, process, or transmit cardholder data, as well as any connected systems that could affect the security of those components.

Question 3

How frequently does PCI DSS require file integrity monitoring (FIM) solutions to perform critical file comparisons on in-scope systems?

Accepted Answer

At least once every week

Answer

PCI DSS Requirement 11 requires that FIM tools perform critical file comparisons at least weekly to detect unauthorized modifications to system files or configurations.

Question 4

What is the primary purpose of deploying an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) within the CDE under PCI DSS?

Accepted Answer

To monitor traffic at the perimeter and at critical internal points to detect and alert on suspicious activity

Answer

PCI DSS requires IDS/IPS deployment at network perimeters and critical internal points to monitor all traffic for indicators of compromise and generate alerts on suspicious activity.

Question 5

Which PCI DSS requirement addresses the protection of cardholder data during transmission over open, public networks?

Accepted Answer

Requirement 4 — Protection of Cardholder Data with Strong Cryptography During Transmission

Answer

PCI DSS Requirement 4 mandates that strong cryptography (e.g., TLS 1.2 or higher) be used to protect cardholder data whenever it is transmitted over open or public networks.

PCI - Certified Payment Card Industry Specialist Practice Test

PCI - Certified Payment Card Industry Specialist Practice Test

PCI Network Security & Architecture 3