PCIP Access Control 3

Question 1

Under PCI DSS, how frequently must access rights for users with access to cardholder data be reviewed?

Accepted Answer

At least every six months

Answer

PCI DSS Requirement 8.1.6 requires that user access rights be reviewed at least every six months to ensure appropriateness.

Question 2

A vendor requires remote access to configure payment terminals. What PCI DSS control must be in place?

Accepted Answer

Vendor access must be enabled only when needed and monitored while active

Answer

PCI DSS Requirement 8.1.5 requires that vendor remote access be enabled only when needed, monitored during use, and disabled immediately after.

Question 3

Which password requirement is mandated by PCI DSS for accounts accessing the cardholder data environment?

Accepted Answer

Minimum 7 characters with numeric and alphabetic characters

Answer

PCI DSS Requirement 8.3.6 specifies passwords must be at least 12 characters (or 8 if the system doesn't support 12), containing both numeric and alphabetic characters.

Question 4

What does PCI DSS require regarding password history to prevent password reuse?

Accepted Answer

Users cannot reuse any of their last 4 passwords

Answer

PCI DSS Requirement 8.3.7 prohibits users from submitting a new password that is the same as any of their last four passwords.

Question 5

A payment application locks user accounts after failed login attempts. What is the PCI DSS-required lockout threshold?

Accepted Answer

6 failed attempts

Answer

PCI DSS Requirement 8.3.4 requires that accounts be locked out after not more than six invalid access attempts.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Access Control 3