Practice Test Geeks(PCIP) Payment Card Industry Professional Practice Test
← All PCIP Flashcard Decks

Access Control Flashcards

7 cards from real PCIP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Access Control flashcards as text

  1. Under PCI DSS, what is the minimum requirement for authenticating users with access to cardholder data environments?

    Answer: Multi-factor authentication is required for all non-console administrative access

    PCI DSS Requirement 8.4 mandates multi-factor authentication (MFA) for all non-console administrative access into the cardholder data environment.

  2. A retail company shares a POS terminal login among three cashiers. Which PCI DSS principle does this violate?

    Answer: Unique user ID requirement

    PCI DSS Requirement 8.2 requires that every user be assigned a unique ID so that actions can be traced to a specific individual.

  3. Which access control model is most aligned with the PCI DSS 'need-to-know' principle?

    Answer: Role-Based Access Control (RBAC)

    RBAC enforces need-to-know by granting permissions based on job roles, ensuring users only access data required for their function.

  4. How long does PCI DSS require that inactive user accounts be locked or removed?

    Answer: 90 days

    PCI DSS Requirement 8.1.4 states that inactive user accounts must be removed or disabled within 90 days.

  5. A systems administrator leaves the company on Friday. According to PCI DSS, when must their access be revoked?

    Answer: Immediately upon termination

    PCI DSS Requirement 8.1.3 requires that access rights for terminated users be removed immediately upon termination.

  6. Which of the following is a valid method to implement physical access controls for a server room housing cardholder data per PCI DSS?

    Answer: Video cameras and badge readers with logged access

    PCI DSS Requirement 9.1 requires physical access controls such as video cameras or access control mechanisms, with access logged and monitored.

  7. An employee transfers from the finance department to marketing. What must happen to their system access per PCI DSS?

    Answer: Old access should be revoked and new access granted based on new role requirements

    PCI DSS requires that access rights be adjusted upon job role changes — prior privileges must be revoked and access re-provisioned based on the new role.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. pcisecuritystandards.org — Test delivery, fees, exam format, passing score, registration, retake fee, time limit · verified Oct 2026
  2. listings.pcisecuritystandards.org — Eligibility, score validity · verified Oct 2026