PCIP Vulnerability Management 3

Question 1

Which of the following is a key characteristic of a zero-day vulnerability in PCI DSS contexts?

Accepted Answer

A flaw exploited before a vendor patch is available

Answer

A zero-day vulnerability is one that is being exploited in the wild before the vendor has released a patch to address it.

Question 2

According to PCI DSS, who is qualified to perform internal vulnerability scans?

Accepted Answer

Qualified internal staff or qualified third parties (internal scans do not require ASV)

Answer

Internal vulnerability scans do not need to be performed by an ASV; they can be done by qualified internal personnel or qualified third parties.

Question 3

A company's web application firewall (WAF) is being used as a compensating control for a vulnerability in a web-facing application. What must the WAF compensating control include?

Accepted Answer

Active monitoring and a defined rule set blocking exploitation of the specific vulnerability

Answer

A WAF used as a compensating control must be actively monitored and configured with rules that specifically prevent exploitation of the unpatched vulnerability.

Question 4

What is the significance of CVE (Common Vulnerabilities and Exposures) identifiers in PCI DSS vulnerability management?

Accepted Answer

CVEs provide a standardized reference for publicly known vulnerabilities, aiding in consistent tracking

Answer

CVE identifiers provide a standardized naming convention for publicly known vulnerabilities, enabling consistent communication and tracking across organizations and tools.

Question 5

Under PCI DSS Requirement 11, after a significant infrastructure change, when must an internal vulnerability scan be performed?

Accepted Answer

After the change is implemented

Answer

PCI DSS requires internal vulnerability scans to be performed after any significant changes to the network or system components.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Vulnerability Management 3