PCIP Security Technologies & Network Architecture 3

Question 1

Under PCI DSS, what is the required frequency for testing firewall and router rule sets?

Accepted Answer

At least every six months

Answer

PCI DSS Requirement 1.2.7 requires that firewall and router configurations be reviewed at least every six months to ensure rules remain appropriate and unauthorized changes are identified.

Question 2

A company implements a web application firewall (WAF) in front of its payment page. According to PCI DSS Requirement 6, what is true about this control?

Accepted Answer

A WAF is one of two acceptable options to address Requirement 6.4 for public-facing web applications, the other being a code review process

Answer

PCI DSS Requirement 6.4 gives merchants the option of either a WAF or a regular vulnerability review/code audit for protecting public-facing web applications from known attack techniques.

Question 3

Which technology is specifically designed to detect and alert on suspicious activity by analyzing network traffic patterns within the CDE?

Accepted Answer

Intrusion Detection System (IDS)

Answer

An IDS monitors network traffic for suspicious patterns and known attack signatures, alerting security staff to potential intrusions within or targeting the CDE.

Question 4

What is the purpose of network time protocol (NTP) synchronization in a PCI DSS-compliant environment?

Accepted Answer

To ensure all system clocks are synchronized for accurate and consistent log timestamps used in forensic investigations

Answer

PCI DSS Requirement 10.6 requires time synchronization so that log timestamps across all CDE systems are consistent, which is essential for correlating events during security investigations.

Question 5

An organization uses tokenization for storing customer payment data. What does tokenization do in the context of PCI DSS?

Accepted Answer

Replaces the PAN with a non-sensitive surrogate value (token) that has no exploitable value outside the tokenization system

Answer

Tokenization replaces the real PAN with a token, and because the token has no mathematical relationship to the original PAN, systems storing only tokens are generally considered out of PCI DSS scope.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Technologies & Network Architecture 3