PCIP Security Monitoring 4

Question 1

What does 'baselining' mean in the context of PCI DSS security monitoring?

Accepted Answer

Establishing normal traffic and behavior patterns to identify anomalies

Answer

Baselining captures normal system behavior and network traffic so that deviations — which may signal attacks — can be detected more accurately.

Question 2

Which PCI DSS control requires verifying that security policies and operational procedures for monitoring are documented and in use?

Accepted Answer

Requirement 10.9

Answer

Requirement 10.9 requires that security policies and operational procedures for monitoring all access to network resources and cardholder data are documented and implemented.

Question 3

A SIEM generates 5,000 alerts per day. Which tuning strategy BEST reduces alert fatigue while maintaining security coverage?

Accepted Answer

Adjust thresholds and create correlation rules to surface high-fidelity alerts

Answer

Correlation rules and threshold tuning reduce false positives and surface actionable, high-confidence alerts without eliminating monitoring coverage.

Question 4

Under PCI DSS, which action is required when a critical security control such as a firewall fails?

Accepted Answer

Implement compensating controls and document the failure immediately

Answer

PCI DSS requires that failures of critical security controls be detected promptly and addressed with compensating controls until the primary control is restored.

Question 5

Which log source is MOST important for detecting unauthorized lateral movement within a CDE network?

Accepted Answer

Internal firewall and network flow logs

Answer

Internal firewall and network flow logs capture east-west traffic between CDE systems, revealing unusual connection patterns that indicate lateral movement.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Monitoring 4