PCIP Assessment Procedures & Reporting Obligations 2

Question 1

During a PCI DSS assessment, a QSA discovers that a merchant stores full PANs in plaintext log files. What is the correct reporting action?

Accepted Answer

Mark the requirement as 'Not in Place' and document findings

Answer

When a control is not met, the QSA must mark it 'Not in Place' and document the specific finding in the ROC.

Question 2

Which document serves as the primary deliverable from a QSA after completing a Level 1 merchant assessment?

Accepted Answer

Report on Compliance (ROC)

Answer

The Report on Compliance (ROC) is the formal deliverable QSAs produce for Level 1 merchant and service provider assessments.

Question 3

A merchant completes an SAQ and finds one requirement partially met. What should they do with the Attestation of Compliance (AOC)?

Accepted Answer

Do not sign the AOC until full compliance is achieved

Answer

An AOC should only be signed when the entity is fully compliant; partial compliance means the AOC cannot be legitimately signed.

Question 4

How often must an Approved Scanning Vendor (ASV) scan be performed for PCI DSS external vulnerability scanning requirements?

Accepted Answer

Quarterly

Answer

PCI DSS requires external vulnerability scans by an ASV to be performed at least quarterly.

Question 5

A service provider fails an ASV scan but has implemented a compensating control. What is the correct procedure?

Accepted Answer

Submit the failing scan report with a compensating control worksheet

Answer

Failing scan results with compensating controls must be submitted with supporting documentation including a completed compensating control worksheet.

(PCIP) Payment Card Industry Professional Practice Test