PCIP Access Control 2 — Questions and Answers
Question 1: Under PCI DSS, what is the minimum requirement for authenticating users with access to cardholder data environments?
- Single-factor authentication is sufficient for all users
- Multi-factor authentication is required for all non-console administrative access (Correct answer)
- Biometric authentication must be used as the primary factor
- Password-only authentication is acceptable if passwords are changed monthly
Correct answer: Multi-factor authentication is required for all non-console administrative access
PCI DSS Requirement 8.4 mandates multi-factor authentication (MFA) for all non-console administrative access into the cardholder data environment.
Question 2: A retail company shares a POS terminal login among three cashiers. Which PCI DSS principle does this violate?
- Principle of least privilege
- Unique user ID requirement (Correct answer)
- Need-to-know access control
- Physical access segregation
Correct answer: Unique user ID requirement
PCI DSS Requirement 8.2 requires that every user be assigned a unique ID so that actions can be traced to a specific individual.
Question 3: Which access control model is most aligned with the PCI DSS 'need-to-know' principle?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC enforces need-to-know by granting permissions based on job roles, ensuring users only access data required for their function.
Question 4: How long does PCI DSS require that inactive user accounts be locked or removed?
- 30 days
- 60 days
- 90 days (Correct answer)
- 180 days
Correct answer: 90 days
PCI DSS Requirement 8.1.4 states that inactive user accounts must be removed or disabled within 90 days.
Question 5: A systems administrator leaves the company on Friday. According to PCI DSS, when must their access be revoked?
- Within 24 hours
- Immediately upon termination (Correct answer)
- Within 3 business days
- At the next scheduled access review
Correct answer: Immediately upon termination
PCI DSS Requirement 8.1.3 requires that access rights for terminated users be removed immediately upon termination.
Question 6: Which of the following is a valid method to implement physical access controls for a server room housing cardholder data per PCI DSS?
- A sign-in sheet monitored by an honor system
- Video cameras and badge readers with logged access (Correct answer)
- A combination lock with a code shared among all IT staff
- A standard door lock with a master key held by management
Correct answer: Video cameras and badge readers with logged access
PCI DSS Requirement 9.1 requires physical access controls such as video cameras or access control mechanisms, with access logged and monitored.
Question 7: An employee transfers from the finance department to marketing. What must happen to their system access per PCI DSS?
- Access is automatically updated by HR systems
- Old access should be revoked and new access granted based on new role requirements (Correct answer)
- Access remains unchanged for 90 days during transition
- The employee retains all prior access plus gains new access
Correct answer: Old access should be revoked and new access granted based on new role requirements
PCI DSS requires that access rights be adjusted upon job role changes — prior privileges must be revoked and access re-provisioned based on the new role.
PCIP Access Control 2
Under PCI DSS, what is the minimum requirement for authenticating users with access to cardholder data environments?