PCIP Compliance Reporting 4

Question 1

Which of the following best describes the scope of a PCI DSS compliance assessment?

Accepted Answer

All system components that store, process, or transmit cardholder data, plus connected systems

Answer

PCI DSS scope includes all system components that store, process, or transmit cardholder data, as well as any systems that could impact the security of the cardholder data environment.

Question 2

What is the purpose of network segmentation in PCI DSS compliance reporting?

Accepted Answer

It reduces the scope of the PCI DSS assessment

Answer

Proper network segmentation isolates the cardholder data environment from other networks, reducing the number of systems in scope and simplifying compliance validation.

Question 3

A merchant uses a fully outsourced hosted payment page where they never receive or access cardholder data. Which SAQ type applies?

Accepted Answer

SAQ A

Answer

SAQ A applies to card-not-present merchants who have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers.

Question 4

What information must a merchant provide to their acquirer regarding third-party service providers used in their cardholder data environment?

Accepted Answer

A list of service providers and confirmation they are PCI DSS compliant

Answer

Merchants must maintain a list of third-party service providers and ensure those providers are PCI DSS compliant, which is often verified through the service provider's AOC.

Question 5

How long must a merchant retain documentation supporting their PCI DSS compliance validation?

Accepted Answer

At least 1 year, per card brand requirements

Answer

Card brand requirements generally mandate that merchants retain PCI DSS compliance documentation for at least one year to support compliance validation inquiries.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Compliance Reporting 4