PCIP Assessment Procedures & Reporting Obligations 3

Question 1

A QSA is assessing a cloud service provider that hosts cardholder data. The cloud provider claims certain PCI DSS controls are the customer's responsibility. What document should define this responsibility split?

Accepted Answer

A Responsibility Matrix or shared responsibility documentation

Answer

A shared responsibility matrix clearly delineates which PCI DSS controls are owned by the cloud provider versus the customer.

Question 2

Which SAQ type is appropriate for e-commerce merchants that fully outsource payment processing and never receive cardholder data electronically?

Accepted Answer

SAQ A

Answer

SAQ A applies to card-not-present merchants who have fully outsourced all cardholder data functions to a PCI DSS-compliant third party.

Question 3

What is the maximum number of days a service provider has to notify acquirers of a suspected or confirmed cardholder data compromise under typical payment brand rules?

Accepted Answer

3 days

Answer

Payment brands generally require notification within 3 days (72 hours) of discovering a suspected or confirmed cardholder data compromise.

Question 4

During a penetration test required by PCI DSS, what is the minimum scope that must be tested?

Accepted Answer

Segmentation controls and all CDE system components

Answer

PCI DSS penetration testing must cover all CDE components and validate that segmentation controls effectively isolate the CDE from out-of-scope systems.

Question 5

A Level 2 merchant transitions to Level 1 after processing volume increases. What new compliance reporting obligation is triggered?

Accepted Answer

An annual on-site assessment by a QSA producing a ROC

Answer

Level 1 merchants must undergo an annual on-site assessment conducted by a QSA resulting in a Report on Compliance (ROC).

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Assessment Procedures & Reporting Obligations 3