Access Control Flashcards

A company uses a shared service account for automated batch processing in the CDE. What PCI DSS requirement applies to this account?

Answer: Service accounts must have unique IDs and their passwords managed per PCI DSS password policy

PCI DSS Requirement 8.2 applies to all accounts including service accounts — each must have a unique ID and comply with password management requirements.

What is the maximum session idle timeout PCI DSS requires for interactive sessions accessing the cardholder data environment?

Answer: 15 minutes

PCI DSS Requirement 8.2.8 requires that sessions be re-authenticated after no more than 15 minutes of inactivity.

Which of the following is an example of 'something you have' in multi-factor authentication for CDE access?

Answer: A hardware token generating one-time codes

A hardware token is a possession factor ('something you have'), distinct from knowledge factors (passwords) and inherence factors (biometrics).

Under PCI DSS, which of the following best describes how group or shared accounts should be handled in the CDE?

Answer: Prohibited — each user must have a unique account

PCI DSS Requirement 8.2.1 prohibits group, shared, or generic user IDs and passwords in the cardholder data environment.

A database administrator needs emergency access to production cardholder data outside normal business hours. What PCI DSS control is most appropriate?

Answer: Use a break-glass account with full logging, requiring post-access review

Break-glass (emergency) accounts must be tightly controlled with complete logging and a mandatory review process after use to maintain PCI DSS compliance.

What does PCI DSS require when cryptographic keys used for access control are compromised or suspected of compromise?

Answer: Keys must be retired and replaced immediately

PCI DSS Requirement 3.7.4 requires that compromised or suspected compromised cryptographic keys be retired and replaced immediately.

Which PCI DSS requirement addresses the need to restrict logical access to audit logs in the CDE?

Answer: Requirement 10 — Log and monitor all access to system components and cardholder data

PCI DSS Requirement 10 covers logging and monitoring, including protecting audit logs from modification and restricting access to only those with a job-related need.