PCIP Access Control 5 — Questions and Answers
Question 1: A penetration test reveals that a developer has retained production CDE access after moving to a QA role. Which PCI DSS process failed?
- Vulnerability scanning schedule
- Periodic user access review or termination/transfer access revocation process (Correct answer)
- Firewall rule review
- Incident response plan
Correct answer: Periodic user access review or termination/transfer access revocation process
PCI DSS requires that access be adjusted immediately upon role changes and verified through periodic access reviews — failure here indicates a gap in the access management lifecycle.
Question 2: Which of the following is a valid compensating control for an entity that cannot implement MFA due to a technical constraint in a legacy system?
- Documenting the exception and accepting the risk permanently
- Implementing additional layers such as IP whitelisting, enhanced monitoring, and strict physical access controls with documented justification (Correct answer)
- Replacing MFA with monthly password rotation
- Requiring users to verbally confirm their identity before login
Correct answer: Implementing additional layers such as IP whitelisting, enhanced monitoring, and strict physical access controls with documented justification
Compensating controls must provide equivalent security and be documented in the entity's Risk Assessment and Compensating Control Worksheet — additional technical and physical controls can substitute for MFA.
Question 3: A QSA reviews an e-commerce merchant's access control policy. The policy requires passwords to change every 90 days. Is this compliant with PCI DSS v4.0?
- Yes — 90-day rotation is explicitly required by PCI DSS v4.0
- No — PCI DSS v4.0 allows flexible password policies if other controls like MFA are in place (Correct answer)
- No — passwords must be rotated every 30 days
- Yes — any rotation frequency is acceptable as long as it is documented
Correct answer: No — PCI DSS v4.0 allows flexible password policies if other controls like MFA are in place
PCI DSS v4.0 removed the mandatory 90-day password change requirement when MFA is implemented, recognizing that frequent rotation can weaken security if it leads to weak passwords.
Question 4: What is the purpose of a 'need-to-know' access control policy in the context of PCI DSS?
- To ensure all staff are trained on PCI DSS requirements
- To limit access to cardholder data to only individuals whose job requires it (Correct answer)
- To provide administrators with full visibility for auditing purposes
- To allow customer service to access all account data for faster resolution
Correct answer: To limit access to cardholder data to only individuals whose job requires it
Need-to-know limits cardholder data exposure by ensuring only individuals with a documented business need are granted access, reducing the risk of insider threats and data breaches.
Question 5: Which PCI DSS requirement mandates that default passwords on system components must be changed before deployment in the CDE?
- Requirement 2 — Apply secure configurations to all system components (Correct answer)
- Requirement 8 — Identify users and authenticate access to system components
- Requirement 6 — Develop and maintain secure systems and software
- Requirement 11 — Test security of systems and networks regularly
Correct answer: Requirement 2 — Apply secure configurations to all system components
PCI DSS Requirement 2.1 explicitly prohibits the use of vendor-supplied defaults for system passwords and other security parameters.
Question 6: An attacker gains access to the CDE by exploiting an account that was not disabled after an employee resignation two weeks prior. Which PCI DSS control failure does this represent?
- Failure to implement MFA on the account
- Failure to immediately remove access upon termination per Requirement 8.1.3 (Correct answer)
- Failure to encrypt the account credentials in transit
- Failure to conduct quarterly vulnerability scans
Correct answer: Failure to immediately remove access upon termination per Requirement 8.1.3
PCI DSS Requirement 8.1.3 requires immediate removal of access for terminated users — a two-week delay represents a direct violation of this control.
Question 7: A large retailer implements attribute-based access control (ABAC) where access decisions consider user role, time of day, and location. How does this align with PCI DSS?
- It violates PCI DSS because only RBAC is recognized
- It satisfies PCI DSS access control requirements if it enforces least privilege and is documented (Correct answer)
- It is only acceptable for physical access, not logical access
- It is non-compliant because location-based controls are not listed in PCI DSS
Correct answer: It satisfies PCI DSS access control requirements if it enforces least privilege and is documented
PCI DSS focuses on outcomes — any access control model that enforces least privilege, maintains unique user IDs, and is properly documented can satisfy the requirements.
PCIP Access Control 5
A penetration test reveals that a developer has retained production CDE access after moving to a QA role.
Which PCI DSS process failed?