PCIP Cardholder Data Environment 3

Question 1

What document is required by PCI DSS to define and describe the boundaries of the CDE, including all in-scope system components?

Accepted Answer

A network diagram showing all CDE connections and data flows

Answer

A business impact analysis (BIA)

Answer

A vulnerability scan report from an Approved Scanning Vendor (ASV)

Answer

A penetration test report covering all external IP addresses

Question 2

Which of the following actions would most directly reduce the scope of PCI DSS for a brick-and-mortar merchant?

Accepted Answer

Implementing a PCI-listed P2PE solution so that card data is never in cleartext on merchant systems

Answer

Deploying antivirus software on all POS terminals

Answer

Training all employees on PCI DSS requirements annually

Answer

Conducting quarterly vulnerability scans of the store network

Question 3

An e-commerce merchant uses an iFrame hosted by a PCI DSS–compliant payment service provider (PSP) to collect payment data directly from customers. How does this affect the merchant's CDE scope?

Accepted Answer

The merchant's scope is significantly reduced because card data goes directly to the PSP's iFrame and never touches the merchant's systems

Answer

The merchant's web server is fully in scope because it hosts the checkout page

Answer

The merchant must still store raw PANs locally for reconciliation purposes

Answer

The merchant's database server becomes in scope because it generates the checkout session

Question 4

Which of the following is a key characteristic that distinguishes the CDE from other in-scope systems under PCI DSS?

Accepted Answer

The CDE consists specifically of systems that store, process, or transmit cardholder data or SAD

Answer

The CDE includes only servers that store encrypted PANs

Answer

The CDE is limited to systems that directly communicate with card brands

Answer

The CDE includes all systems within the organization's network perimeter

Question 5

A service provider manages multiple clients' payment environments. Under PCI DSS, which responsibility does the service provider have regarding its clients' CDE components?

Accepted Answer

The service provider must provide clients with a Responsibility Matrix clarifying which PCI DSS requirements it manages versus those the client manages

Answer

The service provider has no obligations for client CDE components it does not directly manage

Answer

The service provider must obtain its own QSA certification for each client separately

Answer

The service provider must assume full PCI DSS responsibility for each client's environment

Question 6

What is the correct classification of expiration date under PCI DSS data storage rules?

Accepted Answer

Cardholder data that may be stored if protected according to PCI DSS requirements

Answer

Sensitive Authentication Data that must never be stored post-authorization

Answer

Non-sensitive data that has no storage restrictions under PCI DSS

Answer

Sensitive Authentication Data that may be stored with proper encryption

Question 7

When an organization undergoes a significant change such as adding a new payment channel, what must be done regarding PCI DSS scope?

Accepted Answer

The organization must re-evaluate its CDE scope and update network diagrams and data flow documentation before or immediately after the change

Answer

The organization must wait until the next annual assessment to update its scope

Answer

The organization must notify the card brands immediately but does not need to reassess scope until requested

Answer

No action is required if the new channel is managed by a PCI DSS–compliant third party