PCI DSS Requirements & Compliance Framework Flashcards

Under PCI DSS v4.0, which requirement mandates that organizations perform a targeted risk analysis to determine how frequently certain activities must be performed?

Answer: Requirement 12

PCI DSS v4.0 Requirement 12 introduces targeted risk analysis, allowing organizations to define the frequency of certain activities based on their specific risk environment.

A merchant's cardholder data environment (CDE) uses a flat network where all systems can communicate with each other. Which PCI DSS requirement is most directly violated?

Answer: Requirement 1 – Install and maintain network security controls

Requirement 1 mandates network segmentation controls (firewalls/routers) to restrict traffic and isolate the CDE from untrusted networks.

Which PCI DSS scoping concept refers to systems that are NOT in the CDE but could impact its security?

Answer: Connected-to systems

Connected-to systems are outside the CDE but have connectivity to it and must still be assessed for their potential impact on CDE security.

An organization wants to use a customized approach for a PCI DSS v4.0 control. What is required before doing so?

Answer: A documented targeted risk analysis and controls testing methodology

The customized approach in PCI DSS v4.0 requires organizations to document their targeted risk analysis and describe how the customized control meets the stated objective.

Which PCI DSS requirement covers the protection of stored account data, including the use of strong cryptography?

Answer: Requirement 3

Requirement 3 addresses protection of stored account data, mandating that sensitive authentication data not be retained and that stored PANs be protected with strong cryptography.

What is the maximum number of consecutive failed authentication attempts allowed before a user account must be locked out per PCI DSS?

Answer: 6

PCI DSS Requirement 8 specifies that accounts must be locked out after not more than 6 consecutive invalid access attempts.

Which entity publishes the PCI DSS standard and oversees the PCIP certification program?

Answer: PCI Security Standards Council (PCI SSC)

The PCI Security Standards Council (PCI SSC), founded by major card brands, develops and maintains PCI DSS and administers related professional certifications including PCIP.