PCIP Vulnerability Management 2

Question 1

Under PCI DSS, how frequently must internal vulnerability scans be performed?

Accepted Answer

At least quarterly

Answer

PCI DSS Requirement 11.3.1 requires internal vulnerability scans to be performed at least quarterly.

Question 2

Which CVSS score range is generally classified as 'Critical' severity?

Accepted Answer

9.0–10.0

Answer

CVSS scores of 9.0–10.0 are classified as Critical, representing the highest severity vulnerabilities.

Question 3

A merchant discovers a vulnerability that has a patch available but cannot immediately apply it due to operational constraints. What is the PCI DSS-compliant response?

Accepted Answer

Implement compensating controls and document the risk

Answer

When patching is delayed, merchants must implement compensating controls and document the associated risk per PCI DSS guidelines.

Question 4

What is the primary purpose of a vulnerability scan compared to a penetration test?

Accepted Answer

Vulnerability scans identify potential weaknesses; penetration tests actively attempt to exploit them

Answer

Vulnerability scans detect and report potential security weaknesses, while penetration tests actively attempt to exploit those weaknesses to assess real impact.

Question 5

Which PCI DSS requirement mandates that new vulnerabilities be identified and addressed within one month of discovery for high-risk vulnerabilities?

Accepted Answer

Requirement 6.3

Answer

PCI DSS Requirement 6.3 covers security vulnerability management, including addressing high-risk vulnerabilities within one month.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Vulnerability Management 2