Vulnerability Management Flashcards

What is the maximum timeframe PCI DSS allows for deploying critical security patches to cardholder data environment systems?

Answer: One month

PCI DSS Requirement 6.3.3 requires critical patches to be installed within one month of release.

Which tool type is specifically used to assess vulnerabilities in web applications under PCI DSS Requirement 6.4?

Answer: Web application vulnerability scanner or manual code review

PCI DSS Requirement 6.4 requires web-facing applications to be reviewed via an automated web application vulnerability scanner or manual code review.

In a penetration test for PCI DSS compliance, what does 'scoping' determine?

Answer: Which systems, networks, and applications are included in the test

Scoping defines the boundaries of the penetration test, identifying which in-scope systems, networks, and applications will be tested.

A vulnerability scan identifies an open port on a CDE server that is not required for business operations. What is the appropriate PCI DSS response?

Answer: Disable the service and close the port

PCI DSS requires that only necessary services, protocols, and ports be enabled; unneeded ports must be disabled to reduce the attack surface.

How does network segmentation impact the scope of vulnerability scanning under PCI DSS?

Answer: Effective segmentation can reduce the number of systems that must be scanned as part of the CDE

Proper network segmentation isolates the CDE, reducing the number of in-scope systems that require vulnerability scanning.

What must an organization do if a vulnerability scan produces a 'false positive' result?

Answer: Document the false positive with evidence and submit an exception to the ASV for external scans

For external scans, false positives must be documented with supporting evidence and submitted to the ASV, who can confirm and exclude them from the failing findings.

Which of the following is NOT a valid method for satisfying the PCI DSS web application security review requirement for public-facing applications?

Answer: Network-layer penetration test only

A network-layer penetration test alone does not satisfy the web application security review requirement, which demands application-layer assessment via WAF, code review, or web app scanning.