PCIP Cardholder Data Environment 2

Question 1

Which technique is most effective for permanently removing systems from PCI DSS scope?

Accepted Answer

Eliminating the storage, processing, and transmission of cardholder data on those systems

Answer

A system can only be removed from PCI DSS scope if it does not store, process, or transmit cardholder data and cannot impact the security of systems that do; encryption and access controls alone do not descope a system.

Question 2

A merchant implements a point-to-point encryption (P2PE) solution validated by the PCI SSC. What is the key benefit regarding the CDE?

Accepted Answer

The merchant's systems outside the P2PE solution are removed from CDE scope because card data is encrypted at the point of interaction

Answer

A PCI-validated P2PE solution encrypts cardholder data at the point of interaction so that systems downstream that handle only encrypted data may be removed from scope, significantly reducing compliance burden.

Question 3

When scoping the CDE, which category of systems is considered 'connected-to' and therefore in scope?

Accepted Answer

Systems that share a network segment with CDE systems or have unrestricted connectivity to them

Answer

Systems sharing a network segment with CDE systems or having unrestricted network access to CDE systems are considered in scope because they could impact the security of the CDE.

Question 4

Tokenization is used by a merchant to replace PANs with tokens in their database. Which statement accurately describes the scoping impact?

Accepted Answer

The token vault is within PCI DSS scope because it stores the mapping to cardholder data

Answer

The token vault that holds the mapping between tokens and real PANs is in scope for PCI DSS because it stores or provides access to actual cardholder data.

Question 5

How often must a PCI DSS–covered entity identify and document all in-scope system components as part of scoping?

Accepted Answer

At least annually and also before any significant change to the environment

Answer

PCI DSS requires entities to identify and document the scope of their CDE at least once a year and also whenever significant changes occur that could affect scope.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Cardholder Data Environment 2