PCIP PCI DSS Requirements & Compliance Framework 3

Question 1

Under PCI DSS, what is the minimum period for which audit logs must be retained?

Accepted Answer

1 year with 3 months immediately available

Answer

PCI DSS Requirement 10 requires audit logs to be retained for at least 12 months, with the most recent 3 months immediately available for analysis.

Question 2

A service provider stores, processes, or transmits cardholder data on behalf of another entity. What compliance document must they provide to their clients annually?

Accepted Answer

Attestation of Compliance (AOC)

Answer

Service providers must provide an Attestation of Compliance (AOC) to their clients as evidence of their own PCI DSS compliance status.

Question 3

Which PCI DSS requirement specifically addresses the use of multi-factor authentication (MFA) for all non-console administrative access into the CDE?

Accepted Answer

Requirement 8

Answer

Requirement 8 mandates MFA for all non-console administrative access to systems in the CDE, as well as for all remote network access.

Question 4

What does the term 'SAD' refer to in PCI DSS, and what is the key rule regarding it post-authorization?

Accepted Answer

Sensitive Authentication Data — must not be stored after authorization is complete

Answer

Sensitive Authentication Data (SAD) includes full track data, CVV2, and PINs, and PCI DSS absolutely prohibits retaining SAD after transaction authorization.

Question 5

An e-commerce merchant outsources its entire payment page to a PCI-compliant payment processor using an iFrame. Which SAQ is most likely applicable?

Accepted Answer

SAQ A

Answer

SAQ A applies to card-not-present merchants that have fully outsourced all payment processing to a PCI DSS compliant third-party and never receive cardholder data on their own systems.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP PCI DSS Requirements & Compliance Framework 3