PCIP Assessment Procedures & Reporting Obligations 4

Question 1

A newly identified vulnerability is rated Critical (CVSS 9.8) on a system in the CDE. Under PCI DSS Requirement 6, what is the maximum time allowed to remediate it?

Accepted Answer

30 days

Answer

PCI DSS requires critical vulnerabilities in the CDE to be addressed within one month (approximately 30 days) of identification.

Question 2

Which of the following findings would cause an ASV scan to result in a failing report?

Accepted Answer

An SSL 3.0 service exposed on an internet-facing IP

Answer

SSL 3.0 is an insecure protocol and its presence on internet-facing systems constitutes a failing finding in an ASV scan per PCI DSS requirements.

Question 3

What is the role of the Forensic Investigator (PFI) in a post-breach scenario under PCI DSS?

Accepted Answer

To investigate the breach and produce a forensic report for payment brands

Answer

A PCI Forensic Investigator (PFI) is engaged after a breach to investigate, determine root cause, and deliver a forensic report to the requesting payment brand.

Question 4

A QSA must re-assess a merchant within 12 months of the previous report. What triggers a requirement for an interim or unscheduled assessment?

Accepted Answer

A significant infrastructure change to the CDE between assessments

Answer

Significant changes to the CDE—such as new systems, network architecture changes, or major application updates—require the relevant PCI DSS controls to be reassessed.

Question 5

Which PCI DSS requirement specifically mandates that service providers maintain a documented list of all entities they share cardholder data with?

Accepted Answer

Requirement 12 (Support Information Security with Organizational Policies)

Answer

Requirement 12 requires that service providers maintain a list of all entities with which they share cardholder data, including what data is shared and the purpose.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Assessment Procedures & Reporting Obligations 4