PCIP Network Security 5

Question 1

What is the purpose of a 'network diagram' requirement in PCI DSS?

Accepted Answer

To document all connections between the CDE and other networks, enabling accurate scope determination

Answer

PCI DSS requires current network diagrams showing all connections into and out of the CDE so assessors and entities can accurately identify what is in scope.

Question 2

Which technique involves sending specially crafted packets to exploit vulnerabilities in network protocols and is tested during penetration testing?

Accepted Answer

Fuzzing

Answer

Fuzzing sends malformed or unexpected inputs to network services to uncover vulnerabilities that could be exploited by attackers.

Question 3

Under PCI DSS Requirement 11, how frequently must internal vulnerability scans be performed?

Accepted Answer

Quarterly

Answer

PCI DSS Requirement 11.3.1 requires internal vulnerability scans to be performed at least quarterly by qualified personnel.

Question 4

What does 'defense in depth' mean in the context of PCI DSS network security?

Accepted Answer

Implementing multiple overlapping security controls so failure of one does not compromise the entire environment

Answer

Defense in depth applies layered security controls so that if one control fails, additional controls remain to protect cardholder data.

Question 5

Which network security control prevents systems in the CDE from initiating connections to the internet unless explicitly required?

Accepted Answer

Egress firewall rules restricting outbound connections

Answer

Outbound (egress) firewall rules ensure CDE systems can only connect to approved external destinations, limiting the blast radius of a compromise.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Network Security 5