PCIP Assessment Procedures & Reporting Obligations 5

Question 1

A QSA discovers during an assessment that the merchant's previous ROC contained inaccurate findings. What is the appropriate course of action?

Accepted Answer

Report the discrepancy to the PCI SSC's QSA Quality Assurance program

Answer

Concerns about inaccurate prior ROCs should be escalated to the PCI SSC's QSA Quality Assurance program, which oversees QSA performance and report accuracy.

Question 2

Under PCI DSS, how long must an entity retain documentation related to a completed assessment (ROC, AOC, supporting evidence)?

Accepted Answer

At least 1 year, with some evidence retained longer per policy

Answer

PCI DSS requires policies and procedures to be retained for at least 12 months, and entities should retain assessment documentation for at least the same period to support audit trails.

Question 3

A service provider is listed on Visa's Global Registry of Service Providers. What does this listing confirm?

Accepted Answer

The service provider has validated compliance with PCI DSS

Answer

Visa's Global Registry of Service Providers lists entities that have validated their PCI DSS compliance, providing merchants a way to verify their vendors' compliance status.

Question 4

Which scenario correctly describes when a 'Not Applicable' (N/A) designation is permitted in a PCI DSS assessment?

Accepted Answer

When a requirement genuinely does not apply due to the entity's environment or business model

Answer

N/A is only appropriate when a PCI DSS requirement cannot logically apply to the entity's environment—for example, a wireless security requirement for an entity with no wireless infrastructure.

Question 5

What is the primary purpose of the PCI DSS Attestation of Compliance (AOC) document?

Accepted Answer

To formally attest that the entity completed the assessment and the results are accurate

Answer

The AOC is a formal declaration signed by both the QSA (or ISA) and an officer of the entity, attesting that the assessment was completed and results accurately reflect the entity's compliance status.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Assessment Procedures & Reporting Obligations 5