PCIP Cardholder Data Environment 2

Question 1

Which technique is most effective for permanently removing systems from PCI DSS scope?

Accepted Answer

Eliminating the storage, processing, and transmission of cardholder data on those systems

Answer

Encrypting all cardholder data stored on those systems

Answer

Applying strong access controls to limit who can view the data

Answer

Using tokenization to replace card data with a token that is also stored on the system

Question 2

A merchant implements a point-to-point encryption (P2PE) solution validated by the PCI SSC. What is the key benefit regarding the CDE?

Accepted Answer

The merchant's systems outside the P2PE solution are removed from CDE scope because card data is encrypted at the point of interaction

Answer

The merchant no longer needs to implement any PCI DSS controls

Answer

The merchant can store full PANs in plaintext once they exit the P2PE device

Answer

All PCI DSS SAQ types become available to the merchant regardless of transaction volume

Question 3

When scoping the CDE, which category of systems is considered 'connected-to' and therefore in scope?

Accepted Answer

Systems that share a network segment with CDE systems or have unrestricted connectivity to them

Answer

Systems that are on a separate network segment with no direct route to the CDE

Answer

Only systems that directly process PANs

Answer

Any system that has internet connectivity, regardless of network placement

Question 4

Tokenization is used by a merchant to replace PANs with tokens in their database. Which statement accurately describes the scoping impact?

Accepted Answer

The token vault is within PCI DSS scope because it stores the mapping to cardholder data

Answer

The token vault that maps tokens to PANs is outside PCI DSS scope because it contains no raw PANs

Answer

The merchant's systems are entirely out of scope once tokenization is deployed

Answer

Tokenization has no effect on PCI DSS scope

Question 5

How often must a PCI DSS–covered entity identify and document all in-scope system components as part of scoping?

Accepted Answer

At least annually and also before any significant change to the environment

Answer

Only once during the initial assessment

Answer

Every three years as part of the full PCI DSS recertification cycle

Answer

Only when requested by the acquiring bank or card brand

Question 6

A company's CDE is connected to its corporate network via a firewall. If the firewall is misconfigured and allows unrestricted traffic between the two networks, what is the implication for scope?

Accepted Answer

The corporate network systems become in scope for PCI DSS because they can impact the security of the CDE

Answer

The corporate network remains out of scope because the firewall is still physically present

Answer

Only the firewall itself becomes in scope; the corporate network is unaffected

Answer

Scope is unaffected because PCI DSS does not penalize for firewall misconfigurations

Question 7

Under PCI DSS v4.0, which term describes the approach where entities implement controls that meet the intent of a requirement using methods other than those specified?

Accepted Answer

Customized approach

Answer

Compensating control

Answer

Targeted risk analysis

Answer

Best-effort compliance