PCIP Cardholder Data Environment 3

Question 1

What document is required by PCI DSS to define and describe the boundaries of the CDE, including all in-scope system components?

Accepted Answer

A network diagram showing all CDE connections and data flows

Answer

PCI DSS requires entities to maintain a current network diagram that documents all connections to cardholder data and shows all in-scope system components and their data flows.

Question 2

Which of the following actions would most directly reduce the scope of PCI DSS for a brick-and-mortar merchant?

Accepted Answer

Implementing a PCI-listed P2PE solution so that card data is never in cleartext on merchant systems

Answer

A PCI-validated P2PE solution encrypts data at the point of interaction, meaning merchant systems never see plaintext cardholder data, which can significantly reduce or eliminate those systems from CDE scope.

Question 3

An e-commerce merchant uses an iFrame hosted by a PCI DSS–compliant payment service provider (PSP) to collect payment data directly from customers. How does this affect the merchant's CDE scope?

Accepted Answer

The merchant's scope is significantly reduced because card data goes directly to the PSP's iFrame and never touches the merchant's systems

Answer

When a fully-hosted PSP iFrame is used, cardholder data is entered directly into the PSP's environment, so the merchant's systems never receive or process the card data, substantially reducing scope.

Question 4

Which of the following is a key characteristic that distinguishes the CDE from other in-scope systems under PCI DSS?

Accepted Answer

The CDE consists specifically of systems that store, process, or transmit cardholder data or SAD

Answer

The CDE is specifically defined as systems that store, process, or transmit cardholder data or SAD, whereas other in-scope systems are those connected to or capable of impacting the CDE's security.

Question 5

A service provider manages multiple clients' payment environments. Under PCI DSS, which responsibility does the service provider have regarding its clients' CDE components?

Accepted Answer

The service provider must provide clients with a Responsibility Matrix clarifying which PCI DSS requirements it manages versus those the client manages

Answer

PCI DSS requires service providers to supply customers with a clear responsibility matrix (or similar document) delineating which PCI DSS controls the provider manages and which remain the client's responsibility.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Cardholder Data Environment 3