PCIP Compliance Reporting 2

Question 1

Which entity is responsible for validating a Level 1 merchant's PCI DSS compliance?

Accepted Answer

Qualified Security Assessor (QSA)

Answer

Level 1 merchants must undergo an annual on-site assessment conducted by a QSA to validate PCI DSS compliance.

Question 2

What is the primary purpose of the Report on Compliance (ROC)?

Accepted Answer

Detailed assessment report documenting PCI DSS compliance findings

Answer

The ROC is a detailed document completed by a QSA that records the results of a PCI DSS assessment and confirms compliance status.

Question 3

How frequently must a Level 2 merchant using a SAQ submit compliance validation to their acquiring bank?

Accepted Answer

Annually

Answer

Level 2 merchants must submit their SAQ and Attestation of Compliance (AOC) to their acquirer on an annual basis.

Question 4

What does an Attestation of Compliance (AOC) confirm?

Accepted Answer

That the entity has accurately represented its PCI DSS compliance status

Answer

The AOC is a declaration signed by both the merchant/service provider and the QSA confirming that the compliance information in the ROC or SAQ is accurate.

Question 5

A service provider that stores cardholder data processes 300,000 transactions annually. What merchant level does this classify them as?

Accepted Answer

Level 1

Answer

Service providers storing, processing, or transmitting cardholder data for more than 300,000 transactions annually are classified as Level 1.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Compliance Reporting 2