PCIP Vulnerability Management 4

Question 1

What is the maximum timeframe PCI DSS allows for deploying critical security patches to cardholder data environment systems?

Accepted Answer

One month

Answer

PCI DSS Requirement 6.3.3 requires critical patches to be installed within one month of release.

Question 2

Which tool type is specifically used to assess vulnerabilities in web applications under PCI DSS Requirement 6.4?

Accepted Answer

Web application vulnerability scanner or manual code review

Answer

PCI DSS Requirement 6.4 requires web-facing applications to be reviewed via an automated web application vulnerability scanner or manual code review.

Question 3

In a penetration test for PCI DSS compliance, what does 'scoping' determine?

Accepted Answer

Which systems, networks, and applications are included in the test

Answer

Scoping defines the boundaries of the penetration test, identifying which in-scope systems, networks, and applications will be tested.

Question 4

A vulnerability scan identifies an open port on a CDE server that is not required for business operations. What is the appropriate PCI DSS response?

Accepted Answer

Disable the service and close the port

Answer

PCI DSS requires that only necessary services, protocols, and ports be enabled; unneeded ports must be disabled to reduce the attack surface.

Question 5

How does network segmentation impact the scope of vulnerability scanning under PCI DSS?

Accepted Answer

Effective segmentation can reduce the number of systems that must be scanned as part of the CDE

Answer

Proper network segmentation isolates the CDE, reducing the number of in-scope systems that require vulnerability scanning.

(PCIP) Payment Card Industry Professional Practice Test