The Payment Card Industry Professional (PCIP) qualification is aimed at people in IT or IT-related roles who work with payment card security. This page gives you free practice sets by topic, three worked questions with full explanations, a study plan, and the exam format, fees and retake rules as published by the PCI Security Standards Council.
The PCIP has 75 questions and takes about 1.5 hours[1] (PCI Security Standards Council, verified Oct 26, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 75 multiple-choice questions, closed book[1] | PCI Security Standards Council · Oct 26, 2026 |
| Time limit | 90 minutes[1] | PCI Security Standards Council · Oct 26, 2026 |
| Passing score | 75% or higher[1] | PCI Security Standards Council · Oct 26, 2026 |
| Exam fee (Exam only (Non-PO)) | $1,700 USD (rises to $1,900 on 1 Jan 2027)[1] | PCI Security Standards Council · Oct 26, 2026 |
| Exam fee (Training and Exam (Non-PO)) | $2,750 USD (rises to $3,000 on 1 Jan 2027)[1] | PCI Security Standards Council · Oct 26, 2026 |
| Retake fee | $200 per retake[1] | PCI Security Standards Council · Oct 26, 2026 |
| Validity | 3 years from the exam pass date[2] | PCI Security Standards Council · Oct 22, 2026 |
| Delivery | Computer-based at a Pearson test center[1] | PCI Security Standards Council · Oct 26, 2026 |
| Eligibility | At least 2 years of IT or IT-related work experience[2] | PCI Security Standards Council · Oct 22, 2026 |
| Registration opens (2027 training classes) | 1 December 2026[1] | PCI Security Standards Council · Oct 26, 2026 |
According to PCI Security Standards Council, “Exam is 75 multiple choice questions with a 90-minute time limit.”[1]
PCIP is a qualification issued by the PCI Security Standards Council. It shows that you understand the basics of payment card security and the PCI standards. The exam is computer based and closed book, and it is taken at a Pearson testing center. It has 75 multiple-choice questions and a 90-minute time limit. You need 75% or higher to pass, and the Council says the only result it releases is your grade, so you will not get a breakdown of the questions you missed.
To apply, you must submit a resume or CV showing at least 2 years of work experience in an IT or IT-related role. Fees depend on the route. The exam-only option is $1,700 USD and the training and exam option is $2,750 USD. Both are listed to rise on 1 Jan 2027, to $1,900 and $3,000 respectively. Registration for 2027 training classes opens on 1 December 2026.
If you fail, retakes cost $200 per attempt, and the Council sets a time window for them after the failure notice. A passed qualification is valid for 3 years from the exam pass date. Fees, rules and dates can change, so check the official PCI SSC page before you book or pay.
Prepare for the PCIP - Payment Card Industry Professional exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: How often must vulnerability scans be performed by PCI DSS-compliant organizations?
Answer: C. Quarterly
Explanation:
The answer is quarterly. PCI DSS expects vulnerability scans to be run on a regular, repeating schedule, and that schedule is every quarter, for both internal and external scans.
Annually is wrong because a single scan in a period that long leaves new weaknesses undetected for too long. Bi-annually is wrong for the same reason: it is still less frequent than the standard asks. Monthly is wrong because it is more often than the minimum, so it is not what the requirement states, even though more frequent scanning is not harmful.
Rule to remember: when a question asks for the required scan frequency, choose the stated minimum interval, not the most cautious one you can think of.
Question: A systems administrator leaves the company on Friday. According to PCI DSS, when must their access be revoked?
Answer: B. Immediately upon termination
Explanation:
The answer is immediately upon termination. When someone leaves, their access to systems that handle cardholder data should be removed at the moment their employment ends, so there is no gap in which a former employee could still log in.
Within 24 hours is wrong because it allows a delay, even a short one. Within 3 business days is wrong because the Friday departure would leave access open over the weekend. At the next scheduled access review is wrong because reviews are periodic checks, not a trigger for removing access that should already be gone.
Rule to remember: access removal for leavers is event-driven, not calendar-driven. Do not pick an option that waits for a later date.
Question: Which of the following is NOT a valid method for satisfying the PCI DSS web application security review requirement for public-facing applications?
Answer: D. Network-layer penetration test only
Explanation:
The answer is the network-layer penetration test only. The requirement is about public-facing web applications, so the check has to look at the application layer. A network-layer test examines ports, services and hosts, and it does not tell you whether the application itself has flaws such as injection or broken authentication.
A web application firewall is a valid method because it inspects and blocks application traffic. Manual code review by a qualified specialist is valid because it finds flaws in the code directly. Automated web application vulnerability scanning is valid because it tests the running application for known weaknesses.
Rule to remember: for a NOT question, find the option that works at the wrong layer or leaves out the application.
Start by reading the official PCI SSC page for the qualification so you know the format, the eligibility rule and the fees. Then take the Fundamentals and Core Concepts set to see how you do on the vocabulary before you move on to the technical topics.
Work through the remaining sets one topic at a time. After each set, write down every question you got wrong and the reason, using the explanation as a starting point. Group those notes by theme, such as access control, scanning, encryption or incident response, and reread the matching section of the current PCI DSS document from the Council.
Keep the closed-book format in mind. Answer without looking anything up, and do not stop to research a question mid-set. Because the Council releases only your grade, treat your own notes as the only detailed feedback you will get, and review them often.
In the last few days, retake the sets where you had the most errors and finish with the Standards and Best Practices set. Our questions are written by us and are not real exam questions, so use them to find gaps, not to predict what you will see.
The exam has 75 multiple-choice questions and a 90-minute time limit. It is closed book and computer based, taken at a Pearson testing center. Plan your pacing so you can answer every question and still have time to review any you flagged.
You need 75% or higher. The PCI Security Standards Council states that the only information it releases about an exam is your grade, so you should not expect a topic-by-topic score report after a fail.
Candidates must submit a resume or CV showing at least 2 years of work experience in an IT or IT-related role as part of the application. Check the official qualification requirements document for the full details before you register.
The exam-only option is $1,700 USD and the training and exam option is $2,750 USD, rising to $1,900 and $3,000 on 1 Jan 2027. Each retake costs $200. Confirm current fees on the PCI SSC site before paying.
A PCIP qualification is issued for 3 years, starting on the date you passed the exam. Eligible QSA and ISA individuals have a slightly different start date, which is explained in the official requirements document.
How we verify: editorial & fact-checking policy. Report an error: contact us.