Access Control Flashcards

A penetration test reveals that a developer has retained production CDE access after moving to a QA role. Which PCI DSS process failed?

Answer: Periodic user access review or termination/transfer access revocation process

PCI DSS requires that access be adjusted immediately upon role changes and verified through periodic access reviews — failure here indicates a gap in the access management lifecycle.

Which of the following is a valid compensating control for an entity that cannot implement MFA due to a technical constraint in a legacy system?

Answer: Implementing additional layers such as IP whitelisting, enhanced monitoring, and strict physical access controls with documented justification

Compensating controls must provide equivalent security and be documented in the entity's Risk Assessment and Compensating Control Worksheet — additional technical and physical controls can substitute for MFA.

A QSA reviews an e-commerce merchant's access control policy. The policy requires passwords to change every 90 days. Is this compliant with PCI DSS v4.0?

Answer: No — PCI DSS v4.0 allows flexible password policies if other controls like MFA are in place

PCI DSS v4.0 removed the mandatory 90-day password change requirement when MFA is implemented, recognizing that frequent rotation can weaken security if it leads to weak passwords.

What is the purpose of a 'need-to-know' access control policy in the context of PCI DSS?

Answer: To limit access to cardholder data to only individuals whose job requires it

Need-to-know limits cardholder data exposure by ensuring only individuals with a documented business need are granted access, reducing the risk of insider threats and data breaches.

Which PCI DSS requirement mandates that default passwords on system components must be changed before deployment in the CDE?

Answer: Requirement 2 — Apply secure configurations to all system components

PCI DSS Requirement 2.1 explicitly prohibits the use of vendor-supplied defaults for system passwords and other security parameters.

An attacker gains access to the CDE by exploiting an account that was not disabled after an employee resignation two weeks prior. Which PCI DSS control failure does this represent?

Answer: Failure to immediately remove access upon termination per Requirement 8.1.3

PCI DSS Requirement 8.1.3 requires immediate removal of access for terminated users — a two-week delay represents a direct violation of this control.

A large retailer implements attribute-based access control (ABAC) where access decisions consider user role, time of day, and location. How does this align with PCI DSS?

Answer: It satisfies PCI DSS access control requirements if it enforces least privilege and is documented

PCI DSS focuses on outcomes — any access control model that enforces least privilege, maintains unique user IDs, and is properly documented can satisfy the requirements.