Access Control Flashcards

Under PCI DSS, how frequently must access rights for users with access to cardholder data be reviewed?

Answer: At least every six months

PCI DSS Requirement 8.1.6 requires that user access rights be reviewed at least every six months to ensure appropriateness.

A vendor requires remote access to configure payment terminals. What PCI DSS control must be in place?

Answer: Vendor access must be enabled only when needed and monitored while active

PCI DSS Requirement 8.1.5 requires that vendor remote access be enabled only when needed, monitored during use, and disabled immediately after.

Which password requirement is mandated by PCI DSS for accounts accessing the cardholder data environment?

Answer: Minimum 7 characters with numeric and alphabetic characters

PCI DSS Requirement 8.3.6 specifies passwords must be at least 12 characters (or 8 if the system doesn't support 12), containing both numeric and alphabetic characters.

What does PCI DSS require regarding password history to prevent password reuse?

Answer: Users cannot reuse any of their last 4 passwords

PCI DSS Requirement 8.3.7 prohibits users from submitting a new password that is the same as any of their last four passwords.

A payment application locks user accounts after failed login attempts. What is the PCI DSS-required lockout threshold?

Answer: 6 failed attempts

PCI DSS Requirement 8.3.4 requires that accounts be locked out after not more than six invalid access attempts.

After an account is locked due to failed login attempts, what does PCI DSS require before the account is unlocked?

Answer: Automatic unlock after 30 minutes, or manual reset by an administrator

PCI DSS Requirement 8.3.4 allows accounts to be unlocked either after a lockout duration of at least 30 minutes or through administrator intervention.

Which scenario correctly implements the PCI DSS principle of least privilege for a call center agent?

Answer: Agent can view only the last four digits of PANs needed to verify caller identity

Least privilege limits access to the minimum necessary — a call center agent only needs partial PAN data to verify identity, not full cardholder data.