PCIP Security Technologies & Network Architecture 5

Question 1

Which of the following BEST describes the role of a Security Information and Event Management (SIEM) system in a PCI DSS environment?

Accepted Answer

It aggregates and correlates log data from across the CDE to detect security events and support forensic investigation

Answer

A SIEM centralizes logs from CDE systems, correlates events across sources, and generates alerts, directly supporting PCI DSS Requirements 10.4 and 10.7 for log review and retention.

Question 2

Under PCI DSS, what is required if a wireless network is present in the environment but is NOT connected to the CDE?

Accepted Answer

The organization must ensure the wireless network cannot reach the CDE and must perform quarterly scans for unauthorized wireless access points

Answer

Even wireless networks not connected to the CDE must be monitored for rogue access points that could bridge into the CDE, per PCI DSS Requirement 11.2.

Question 3

Which of the following is a characteristic of 'split tunneling' that makes it a security concern in PCI DSS remote access scenarios?

Accepted Answer

Split tunneling allows a remote device to access both the CDE VPN and the internet simultaneously, potentially creating a bypass path into the CDE

Answer

With split tunneling, a compromised remote device connected to the CDE VPN can also have its internet-connected interface leveraged as a pivot point, violating PCI DSS isolation requirements.

Question 4

What is the purpose of file integrity monitoring (FIM) in the context of PCI DSS Requirement 11?

Accepted Answer

To detect unauthorized changes to critical system files, configuration files, and content files on CDE systems

Answer

FIM generates baseline hashes of critical files and alerts when any unauthorized modification is detected, helping identify malware implantation or unauthorized configuration changes.

Question 5

An organization is evaluating cloud hosting for its payment application. Which statement is MOST accurate regarding PCI DSS scope in cloud environments?

Accepted Answer

The organization retains responsibility for its own PCI DSS compliance even in the cloud; the scope of the cloud provider's responsibility depends on the service model and a validated shared responsibility agreement

Answer

PCI DSS compliance in the cloud operates under a shared responsibility model; even with a compliant cloud provider, the customer must ensure its own in-scope configurations, applications, and data handling meet PCI DSS requirements.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Security Technologies & Network Architecture 5