PCIP PCI DSS Requirements & Compliance Framework 4

Question 1

A QSA is reviewing a merchant's penetration test. PCI DSS v4.0 requires external penetration testing be performed at what minimum frequency?

Accepted Answer

Annually and after significant infrastructure changes

Answer

PCI DSS Requirement 11 mandates external penetration testing at least annually and after any significant changes to the network or application infrastructure.

Question 2

Under PCI DSS, which of the following is an example of a compensating control?

Accepted Answer

Using an IDS to monitor the CDE when isolating a legacy system that cannot support encryption

Answer

Compensating controls are alternative measures used when an entity cannot meet a PCI DSS requirement as stated, such as using enhanced monitoring for a legacy system that cannot be upgraded.

Question 3

Which merchant level requires an annual on-site assessment by a Qualified Security Assessor (QSA)?

Accepted Answer

Level 1 – more than 6 million transactions

Answer

Level 1 merchants (over 6 million transactions annually) are required to undergo a full annual on-site QSA assessment and produce a Report on Compliance (ROC).

Question 4

PCI DSS Requirement 4 governs cardholder data in transit. Which protocol is explicitly prohibited for protecting cardholder data?

Accepted Answer

SSL and early TLS versions

Answer

PCI DSS explicitly prohibits the use of SSL and early TLS (prior to TLS 1.2) for protecting cardholder data in transit due to known cryptographic weaknesses.

Question 5

When must an organization perform a PAN discovery scan of systems according to PCI DSS v4.0 Requirement 12?

Accepted Answer

As part of a targeted risk analysis defined frequency

Answer

PCI DSS v4.0 allows organizations to define the frequency of PAN discovery scans through a targeted risk analysis documented under Requirement 12.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP PCI DSS Requirements & Compliance Framework 4