PCIP Vulnerability Management 5

Question 1

What is the role of threat intelligence in a PCI DSS-aligned vulnerability management program?

Accepted Answer

It provides context about active exploits to help prioritize remediation

Answer

Threat intelligence identifies which vulnerabilities are being actively exploited, helping organizations prioritize remediation of the most dangerous flaws first.

Question 2

Under PCI DSS, what happens to the ASV scan requirement if a merchant acquires a new external IP address range mid-quarter?

Accepted Answer

The new range must be included in an out-of-cycle scan before it processes card data

Answer

Any new external-facing infrastructure that enters the CDE scope must be scanned before it can be used to process card data, regardless of quarterly scheduling.

Question 3

Which of the following describes a penetration test methodology that is consistent with PCI DSS Requirement 11.4?

Accepted Answer

Industry-accepted approach covering network and application layers with exploitation attempts

Answer

PCI DSS requires penetration tests to follow an industry-accepted methodology covering both network and application layers with actual exploitation attempts.

Question 4

A penetration tester successfully pivots from a non-CDE system into the cardholder data environment. What does this finding indicate about the organization's controls?

Accepted Answer

Segmentation controls have failed and must be reviewed and remediated

Answer

A successful pivot into the CDE demonstrates that network segmentation has failed, requiring immediate remediation to restore isolation of cardholder data.

Question 5

What is the minimum frequency for penetration testing of the CDE per PCI DSS Requirement 11.4?

Accepted Answer

Annually and after significant infrastructure or application changes

Answer

PCI DSS requires penetration testing at least annually and after any significant changes to the CDE network or applications.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Vulnerability Management 5