PCI DSS Requirements Practice Test

These questions are part of the practice quiz. Start practicing

• Which statement best describes a Virtual Appliance?
• Which statement reflects the requirement for encrypting CHD transmissions?
• Payment processors typically provide acquiring services, but are not considered acquirers unless defined as such by a payment card brand. Which term best describes this entity?
• Which action demonstrates compliance with securing router configurations under 1.2.2?
• Which activity supports verifying that firewall rule-set reviews occur at least every 6 months per 1.1.7?
• Split Knowledge is a cryptographic concept where two or more entities separately hold key components that individually reveal no knowledge of the final cryptographic key. Which option best describes this concept?
• Which protocol do Web Servers primarily handle requests for?
• Default accounts and passwords are often published and well known, which makes them particularly susceptible to what?
• In PA-DSS versioning, what does a wildcard indicate?
• TACACS is commonly used to determine user access rights and may be used with what for two-factor authentication?
• Which statement best defines a Service Provider?
• Which maintenance activities are required for antivirus mechanisms?
• What is a Default Account?
• Which describes a firewall?
• For custom code updates, what must be done before deployment into production according to PCI DSS requirements?
• What is Authentication?
• What is sampling?
• Which term refers to the set of rules governing how sensitive information is managed, protected, and distributed?
• For shared hosting providers, what is required to protect hosted environments?
• Which term describes tests that attempt to identify ways to exploit vulnerabilities, including external and internal testing?
• What should you observe about firewalls relating to internet connections and DMZ per 1.1.4?
• Which is a valid requirement for secure crypto key storage?
• What evidence demonstrates that dev/test and prod are separated?
• Who may view full PAN displays according to masking policy?
• When defining access needs for each role, what should be included?
• When selecting a sample of users terminated in the past six months, what should you verify?
• Which statement best describes smart cards?
• Which term represents Card Validation Code 2?
• Which statement best defines a Payment Processor?
• How often must the incident response plan be tested?
• Change Control refers to which of the following?
• Regarding any disclosure of private IP addresses and routing information to external entities, what must be verified?
• For audit trails, which entry must be recorded to identify the kind of event that occurred on system components?
• What does PCI DSS stand for?
• Which is an insecure service/protocol/port example?
• Where should logs for external-facing technologies be written?
• What must security policies and operational procedures for security monitoring and testing be?
• Which statement best describes how to validate CHD transmission security over open networks?
• WLAN stands for which phrase?
• AOV stands for which form?
• Who must know the documented security policies and procedures?
• Full track data includes which portions of the magnetic stripe?
• Which statement best describes the status of identification and authentication policies?
• An Audit Log provides a chronological record of system activities that enables what?
• What does Req 1.1 require to establish and implement?
• What is the purpose of classifying media?
• During the most recent 12 months, how many internal vulnerability scans must be performed?
• Which practice minimizes cardholder data (CHD) storage by enforcing limits on data retention?
• Which option best describes how to avoid private networks from being advertised on the internet?
• What is a Virtual Appliance (VA)?
• What is the objective of 1.2 regarding untrusted networks?
• Which term is Card Verification Value 2 used by Visa cards?
• What does ECC stand for?
• What is Truncation used for in protection of PAN?
• What is the purpose of parameterized queries in SQL?
• What mechanism should be used on logs to detect and alert on changes to existing data?
• What term defines the set of laws, rules, and practices that regulate how an organization manages, protects, and distributes sensitive information?
• Which data element from the magnetic stripe should not be stored after authorization?
• What is the term for dividing steps in a function among different individuals to prevent subversion?
• What should be examined to verify 1.1.2 is implemented?
• In the context of access control, what does authorization define?
• Which areas are excluded from 'sensitive areas' as defined in PCI DSS?
• Which term describes the data element on a card's magnetic stripe that uses secure cryptographic processes to protect data integrity and reveals any alteration?
• Double-length TDES keys used in unique key per transaction implementations are considered to provide an equivalent level of strong cryptography. Which statement is correct?
• Secure wipe is also called what, described as overwriting data to render it irretrievable?
• Which item related to business continuity is required to be included in the incident response plan?
• What is the required review frequency for firewall & router rule sets per 1.1.7?
• CIS is an acronym for which organization?
• What is the target migration completion date for SSL/early TLS in the documented plan?
• IP Address Spoofing is an attack technique used to gain unauthorized access by forging the source IP address.
• What does FIPS stand for?
• GPRS is best described as which?
• Which verification step ensures that access control is applied comprehensively?
• Which training content is required for point-of-sale personnel?
• Which methods are acceptable for educating personnel per Req 12.6?
• Which term describes a software layer that enables running multiple virtual machines on a single physical host?
• Which term is commonly known as the Card Security Code?
• In the context of rendering cardholder data unreadable, hashing should be applied to which data?
• Which term describes the processes for key creation, storage, rotation, and destruction?
• What does SHA stand for, and which versions are included?
• What does ECC stand for in cryptography?
• What is the lifecycle called that includes planning, analysis, design, testing, and implementation?
• What should the current diagram show per 1.1.3?
• What determines the frequency of reviewing logs for all other system components?
• What best describes the Virtual Machine Monitor (VMM)?
• What should be logged under identification/authentication mechanism use and privileged account changes?
• To ensure least privilege for privileged user IDs, what should be verified?
• What should inbound internet traffic be limited to in the DMZ?
• Which files are considered critical for change-detection purposes?
• Which of the following describes the required frequency for an annual risk assessment?
• Which item must be included in the documented crypto architecture for CHD protection?
• Which statement about wireless security protocols is true?
• Merchant definition in PCI DSS terms is?
• Which statement describes the requirement for malware protection on systems?
• The penetration testing methodology must include which of the following?
• Which action is required for high-risk vulnerabilities identified in the vuln ID process?
• Req 2.2.2 requires enabling only necessary services, protocols, and daemons. Which action demonstrates this?
• Network Administrator responsibilities include?
• What is the primary purpose of OCTAVE?
• What must be ensured about outbound traffic from the CDE to the Internet?
• Policies must specify acceptable network locations for the technologies. Which choice is correct?
• What is required regarding the assignment of information security management responsibilities?
• In security terminology, what does 'ID' typically denote?
• Before production activation, what must happen to test data and test accounts?
• External vulnerability scan results are considered passing when which condition is met?
• In an IDS, which component stores events logged by sensors in a database?
• Which sources are used to identify new security vulnerabilities in the vulnerability management process?
• Which statement describes a valid method for destroying hard-copy materials containing cardholder data under PCI DSS requirements?
• Which statement accurately describes the requirement for the device list in 9.9.1?
• Which term is used to protect PAN when displayed on screens or receipts?
• What time metadata must be included in audit logs for system components?
• The AOC attestation relates to PCI DSS assessment results as documented in which forms?
• What does CDE stand for in PCI DSS terminology?
• RFC 1918 defines?
• Which action best describes immediate revocation of access for terminated users?
• Which statement about LPAR is true?
• Which statement reflects that only established inbound connections are allowed into the network?
• Which activity verifies that responsible personnel understand the security policies?
• What is a Virtual Machine?
• Upon completion of a significant change, which of the following is required?
• Usage policies should require authentication for all technology use to be authenticated with user ID and password or other authentication item. Which choice reflects this requirement?
• What is required for audit trail entries for all system components events?
• What does Organizational Independence ensure in an assessment process?
• What practice is required to ensure all critical system clocks are synchronized?
• What is Track Data in payment card transactions?
• Which items are cited as examples of critical technologies?
• In PA-DSS terms, what is a Payment Application?
• Which protocol provides encryption for network services like remote login or remote file transfer?
• Which item must be recorded to verify who authorized a visitor's access?
• Which term is used to describe the initial step of identifying the scope for a PCI DSS assessment?
• What describes an Input Variable in hashing processes?
• When personnel access cardholder data via remote-access technologies, what is prohibited unless explicitly authorized for a defined business need?
• Which statement about risk analysis is true?
• For wireless access points that are authorized, which element must be documented?
• In assessments of public-facing apps, what must be true about vulnerabilities from Requirement 6.5?
• What does PDA stand for in the context of handheld devices?
• PAN stands for?
• What activity verifies that vendor remote access accounts are monitored during use?
• Which term is defined as 'mechanisms that limit availability of information or information-processing resources only to authorized persons or applications'?
• To verify significant change compliance, which set of actions should be used?
• What is a Virtual Payment Terminal?
• External penetration testing must be performed at least how often and by whom?
• What is the retention requirement for audit trail history?
• When using authentication mechanisms such as tokens or smart cards, how should they be assigned?
• Which device-list detail is explicitly required by 9.9.1?
• Which term describes all purchased and custom software programs or groups of programs, including both internal and external (for example, web) applications?
• Which setting should be verified to ensure restricted access by default?
• Which of the following is an example of a public network?
• Which term refers to testing the security of networks and applications, conducted from both outside and inside the environment?
• MO/TO stands for?
• How can a Web Application be accessed?
• Which term represents Card Authentication Value 2?
• What should be verified regarding vendor defaults and default accounts before installing a system on the network?
• Which department should management consult to confirm pre-hire background checks for personnel with access to cardholder data?
• For user identification in log entries, what must be included?
• Which practice is explicitly recommended in system config standards?
• What is the minimum retention period for audit trails and the requirement that some be available online?
• What security policy element must be documented, in use, and known to all affected parties regarding monitoring access to network resources and cardholder data?
• ASV stands for which type of vendor?
• Req 2.2.4 is about configuring security parameters. How should you verify these parameters?
• What is the primary purpose of the incident response plan described in the PCI DSS requirements?
• Which term is the initial point of data reading from a card in a payment transaction?
• ISO is described as which type of organization?
• Security policies & operational procedures for protecting systems against malware must be...
• Which statement about cryptography for credentials is correct?
• What is an Encryption Algorithm?
• Regarding shared hosting provider compliance, what is true about the relationship between provider compliance and customer compliance?
• In a virtualized environment, what should be implemented per virtual system component?
• Which magnetic stripe data elements may be retained for business needs?
• Which practice is commonly included to mitigate broken authentication and session management?
• What does the policy require regarding storage and maintenance of all media?
• Which method is an approved way to render cardholder data on electronic media unrecoverable?
• In information security, what best defines a threat?
• Which items require restricted physical access as per PCI DSS requirements?
• As part of PCI DSS requirement 9.1, what should be observed about a system administrator attempting to log into consoles for randomly selected systems?
• AOC stands for which PCI DSS attestation form?
• What should be examined to verify that an access control system is properly implemented?
• A local area network typically shares what?
• Which statement best describes logging of audit trails for system components?
• Which statement best reflects the guidance for addressing buffer overflows in secure coding?
• In addition to annual execution, when else must risk assessments be performed?
• Do not store PIN or encrypted PIN block after auth. Which option best reflects this?
• What should the formal security awareness program achieve?
• Which organization provides computer security training and professional certification?
• Which statement best describes coverage of access control on system components?
• Which technique encrypts the full contents of a disk?
• In PCI DSS terminology, Payment Processor is sometimes described as which of the following?
• Which statement describes a media destruction policy under 9.8?
• Before granting access to system components or cardholder data, what must be done?
• Req 2.2.3 focuses on securing insecure services. Which approach reflects this requirement?
• Stateful Inspection is also called dynamic packet filtering; it tracks the state of network connections and only permits packets that match an established connection. What best describes this concept?
• A Rainbow Table Attack uses a pre-computed table for what purpose?
• Which statement best describes TLS in network communications?
• If SSL or early TLS is used, what must be completed?
• NTP is the protocol used for:
• Where should system components that store cardholder data be placed to minimize exposure to untrusted networks?
• What is required regarding perimeter firewalls between wireless networks and the CDE?
• Req 2.2.5 emphasizes removing unnecessary functionality. What should be verified about system components?
• Which statement is true about GSM roaming?
• What must be in place to authorize visitors?
• Which entity may store sensitive authentication data after auth with business justification and secure storage?
• Which term is defined as a software firewall product installed on a single computer?
• PAN corresponds to which term in the material?
• A CHD retention policy must include the following element?
• Which of the following is an example of malware?
• Which term is an acronym for a standard used to convey vulnerability severity?
• Which term is the acronym for Post Office Protocol v3, used by e-mail clients to retrieve e-mail from a remote server?
• Which statement about LPAR is true?
• Which control best enforces separation between development/testing environments and production in change management?
• Which aspects should be examined to verify the use of file-integrity monitoring or change-detection software on logs?
• Which statement best describes the required validation before installing a system on the network regarding vendor defaults and default accounts?
• Network-layer penetration testing should include which components?
• What do the firewall standards require per 1.1.4?
• After significant changes, what must be done regarding vulnerability scanning?
• If there is an authorized business need, how should cardholder data be protected?
• TELNET is typically used to provide what kind of session, and how are credentials transmitted?
• In security contexts, a 'Log' is typically synonymous with which term?
• An Intrusion Detection System is composed of which components?
• A diagram showing how data flows through an application, system, or network.
• What policy must be maintained regarding information security?
• System Components in the cardholder data environment include what?
• Which statement best describes an Operating System (OS)?
• Information Security is defined as the protection of information to ensure what?
• Who is assigned the responsibility for administering user accounts, including additions, deletions, and modifications?
• Which items are considered Sensitive Authentication Data?
• What must the shared hosting provider have to enable timely forensic investigation under A.1.4?
• Req 2.3 requires encrypting non-console admin access using strong cryptography. Which practice demonstrates compliant non-console admin access?
• A Rainbow Table Attack is best described as?
• Which type of monitoring system alerts should be included in the incident response plan?
• What must be true about security policies and operational procedures for developing and maintaining secure systems and applications?
• Why are live production PAN data not used for testing or development?
• What action is required when media is moved from a secured area?
• What is the main purpose of req 9.4?
• What must be verified about personnel designated for incident response?
• At a minimum, cardholder data consists of which item?
• If an unauthorized wireless access point is detected, what must the incident response plan define?
• What characteristics must visitor badges have?
• Which of the following describes the required background checks before hiring personnel who will have access to cardholder data (Req 12.7)?
• What is a WAN?
• What must be implemented to respond to alerts generated by the change-detection solution?
• For a sampled change, which of the following must functionality testing verify to ensure no security regression?
• ROC stands for which term?
• Which of the following describes the password requirements?
• Which item is a U.S. government resource for vulnerability management data?
• Which statement is NOT aligned with Req 6.5 for software development practices?
• What must be verified about router configurations to meet 1.2.2?
• Which acronym stands for PIN verification value encoded in the magnetic stripe of a payment card?
• Triple DES (3DES) uses the DES cipher how many times?
• Audit Log is also referred to as which term?
• SysAdmin is an abbreviation for system administrator. Which option correctly expands the abbreviation?
• How often must passwords be changed?
• SAQ stands for which term in PCI DSS contexts?
• How often should the information security policy be reviewed?
• Software development processes must be developed how?
• Which activity helps verify that audit trails are protected from alteration?
• Malicious software or malware is software designed to infiltrate or damage a computer system without the owner's knowledge or consent?
• What is the primary function of DNS?
• Which action improves security for wireless devices?
• Which of the following defines a Sensitive Area?
• What must visitors do with their badge or identification when leaving the facility or when it expires?
• If manual clear text key mgmt is used, what enforcement is required?
• Bluetooth is best described as which of the following?
• Which policy correctly addresses sending PANs via end-user messaging technologies?
• Which statement about application IDs in database access is correct?
• Which statement correctly describes HTTPS?
• What is required for service providers who share keys with customers?
• Dual control is a process where two or more separate entities operate in concert to protect sensitive materials. Which statement best describes its principle?
• Which statement about WEP is true?
• Risk assessment documentation should be reviewed to verify annual execution and triggers for significant changes. Which is true?
• What method should be used, in addition to policy review, to verify that daily log reviews are performed?
• Which entity is described as the 'merchant bank' in payment card transactions?
• Which statement about data transmission over the public network is true?
• Which term describes a network that connects computers without physical wires?
• What does OCTAVE stand for?
• Which statement is NOT a criterion for compensating controls?
• How can you verify that the documented incident response plan was followed for actual incidents?
• Which statement is true about TLS in network communications?
• Which action best supports verification of user identification management procedures?
• What is the purpose of Segregation of Duties (SoD) between development/test and production environments?
• Which device connects two or more networks and routes traffic based on addresses?
• Strong cryptography is based on industry-tested algorithms with minimum 112-bit effective key strength and proper key-management practices. Which statement best describes this concept?
• RADIUS is primarily used as what kind of system?
• Which statement correctly describes IP (Internet Protocol)?
• What best describes a VPN connection?
• Which statement describes how version numbers relate to software state changes?
• Which IDS component is used to monitor events and alerts and control sensors?
• What does PIN stand for?
• DSS stands for Data Security Standard. In the PCI context, which statement about DSS is true?
• ISO is described as which type of organization?
• CERT stands for which of the following?
• What is the term for the main computer hardware on which software is resident?
• Non-Console Administrative Access refers to:
• Which best describes Anti-Virus software?
• Why are reputable outside sources used in the vulnerability management process?
• Which term is an agreed-upon method of communication used within networks, describing rules and procedures that devices should follow?
• What should be verified about antivirus deployment on a sample of system components?
• Under A.1.2, which statement correctly describes how application processes should run?
• Which technique is used to address improper access control?
• Which statement about GPRS is most accurate?
• What is Authentication Credentials?
• SANS stands for which description?
• Spyware is a type of malware that intercepts or takes partial control of a user's computer without the user's consent. Which option best describes spyware?
• What should security policies and procedures for restricting access to cardholder data be?
• Which statement about the IETF is true?
• Which term stands for information that can identify an individual, including name, address, SSN, or biometric data?
• How should CHD on removable media be protected?
• In PCI DSS, what term is used to refer to the corporation, organization, or business undergoing the review?
• Which action would most accurately indicate that authentication policies are being communicated to users?
• What is the recommended minimum effective key strength for new cryptographic implementations?
• Magnetic-Stripe Data is also known as what?
• What best describes a hosting provider?
• ANSI stands for which organization?
• During testing of Req 2.3, what should you verify about admin login?
• Default Accounts are login accounts predefined in a system to permit initial access when the system is first put into service. Which statement is true?
• What capabilities must the automated front-end security solution have for public-facing web apps?
• Which discipline concerns information security, particularly encryption and authentication, used as a tool for access control, confidentiality, and integrity?
• Which statement best defines a Trojan?
• Application-layer penetration tests must include at least which of the following?
• For service providers only, what must the written agreement confirm regarding PCI DSS obligations?
• Which areas are defined as sensitive in PCI DSS context?
• What is required to monitor entry and exit to sensitive areas and what is the data retention requirement?
• When validating authentication methods for each type of system component, what must be observed?
• Which policy requirement applies to activation of remote-access technologies used by vendors and business partners?
• In tokenization, which statement is true about the Index Token?
• Which statement accurately reflects the responsibility for monitoring and controlling all access to data?
• What must be logged to reconstruct access to all audit trails?
• What does virtualization refer to?
• Non-Consumer Users are:
• Which statement best defines forensics in information security?
• Penetration testing must be conducted by which type of tester?
• If disk encryption is used, how should logical access to encrypted data be managed?
• Which technique encrypts the full contents of specific files?
• Which entry must be recorded to show which data, system component, or resource was affected by an event?
• What is the purpose of Ingress Filtering?
• Which term describes monitoring of files or logs to detect modifications and generate alerts?
• Which statement best describes an insecure protocol/service/port?
• Who is the primary person responsible for an entity's security-related matters?
• External vulnerability scans must be performed by which entity?
• A visitor log is used to record physical access to which locations?
• Which term refers to the open internet protocol used to transfer information on the World Wide Web?
• Which statement best describes PA-DSS in the context of payment software?
• What is the primary function of risk analysis?
• Which term is the acronym for Point of Interaction, the initial point where data is read from a card?
• NMAP is best described as:
• Which description best defines Transaction Data?
• What is the purpose of audit trails in PCI DSS?
• Which term refers to a device used to input a PIN for authentication?
• Which group must have information security responsibilities clearly defined in the security policy and procedures?
• What is the purpose of ensuring KEKs are strong relative to data keys?
• Network Security Scan is best described as:
• For testing readability during storage, which observation verifies passwords are unreadable?
• How should authentication mechanisms be managed with regard to user accounts?
• Which measure best satisfies PCI DSS requirement to limit and monitor physical access to systems in the cardholder data environment?
• What does anti-spoofing work to accomplish?
• Which term includes all purchased and custom software programs or groups of programs, including internal and external (for example, web) applications?
• Two-Factor Authentication requires what?
• What is the recommended method to ensure audit trails cannot be altered?
• What is a key principle for storing crypto keys to minimize locations?
• Payment cards used under PCI DSS often bear logos for which brands?
• Issuing services may include authorization and card personalization.
• What is the value that determines the output of an encryption algorithm when transforming plain text to ciphertext?
• BAU stands for which of the following?
• Which item is a requirement for protecting keys used to encrypt CHD?
• Network segmentation's effect on the scope of the cardholder data environment is:
• What distinguishes Wireless Networks from wired networks?
• TLS should be enabled for CHD transmissions whenever possible.
• What does Req 12.8.1 require you to do regarding service providers?
• Which term describes a security device that filters traffic between networks?
• Which term describes mechanisms that limit availability of information to authorized persons or applications?
• What must be included when describing alerts in the incident response plan?
• In the PA-DSS context, what is a dependency?
• Which term defines the time-based validity of a cryptographic key?
• What is the hypervisor?
• Identify all wireless networks transmitting CHD or connected to the CDE; verify industry best practices are used and weak encryption is not used.
• What should trigger a policy update for information security?
• The AOV is used by PA-QSAs to attest to PA-DSS assessment results as documented in which report?
• What does the acronym PCI stand for?
• Disk Encryption is a technique for encrypting all stored data on a device. Which encryption alternatives are used to encrypt contents of specific files or columns?
• Which data element must not be stored after authorization (auth)?
• During an audit, which action demonstrates that authentication policies are distributed and understood by users?
• What is a session token in web session management?
• Which statement about TCP is correct?
• Under Req 12.6.2, how must personnel acknowledge understanding of the security policy and procedures, at least annually?
• Account Data refers to what?
• The service code is a three-digit or four-digit value used for what purpose?
• What is the minimum lockout duration after a user is locked out?
• Who is responsible for establishing, documenting, and distributing security policies and procedures?
• What is RSA?
• For wireless detection, which of the following statements is correct?
• Which activity is commonly associated with issuing services?
• In payment card terminology, what does PAN stand for?
• Default accounts and passwords are predefined and usually associated with default accounts. Which statement is true?
• Removable Electronic Media includes which of the following?
• What should a risk assessment produce as its result?
• How should production data be treated in testing or development?
• PA-QSA stands for which role?
• For each sampled change, which item must be present in the change control documentation?
• Acronym for 'Common Vulnerability Scoring System' used to convey the severity of computer system security vulnerabilities.
• Which statement best describes a proxy server's function?
• Which item is a principle of improper access control listed in 6.5.8?
• Which expansion for the acronym PCI is correct?
• A secure cryptographic device is a set of hardware, software and firmware that implements cryptographic processes within a boundary. Which term describes this concept?
• What is the primary focus of PCI DSS Requirement 9?
• Remote Lab Environment is a lab not maintained by the PA-QSA.
• What is required to restrict access to publicly accessible network jacks?
• Acronym for 'point of sale' and refers to hardware and/or software used to process payment card transactions at merchant locations.
• Which describes how vendor remote access accounts should be managed?
• Which of the following best describes the PCI DSS requirement for security awareness training (Req 12.6)?
• Which statement describes preimage resistance?
• Physical access must be restricted to which items?
• Which account-related activities should be logged to track changes in authentication and privileges?
• Which technology tracks the state of network connections to enforce rules?
• Which vulnerabilities are included in Injection Flaws?
• What is an Encryption Algorithm?
• What statement accurately describes the requirement for security policies and procedures related to monitoring access to network resources and cardholder data?
• Which of the following is typically included in system config standards?
• Which option is NOT part of Two-Factor Authentication as defined?
• URL stands for what?
• For systems not typically affected by malware, what action is required to determine whether antivirus is still necessary?
• Which of the following is a known sign that a card-reading device may have been tampered with or substituted?
• NAT stands for?
• How should access for onsite personnel to sensitive areas be controlled?
• What is the objective of implementing automated audit trails across system components?
• Which data block encapsulates a PIN during processing and may contain the PIN length and a subset of the PAN?
• Which statement reflects the handling of generic and shared IDs in access control?
• Which instruction belongs in documented procedures to inspect devices for tampering or substitution?
• Which statement correctly describes TELNET security risk?
• Issuer is an entity that issues payment cards or supports issuing services, including issuing banks and issuing processors.
• What is the target timeframe for installing critical vendor-supplied security patches?
• Which items must be logged regarding the lifecycle of audit logs?
• Which term describes the logical (virtual) connection points associated with a communication protocol to facilitate communications across networks?
• Which elements should be included in change control documentation to satisfy change control requirements?
• A merchant that accepts payment cards for goods or services can also be a service provider if which condition is met?
• What is IPSEC?
• RADIUS stands for?
• What information must be maintained to map PCI DSS requirements to service providers and the entity?
• How should access to crypto keys be restricted?
• What is the minimum frequency for developer secure coding training under Req 6.5?
• Which practice is required to detect unauthorized wireless access points on a quarterly basis?
• What should 1.1.6 documentation include?
• Which device is typically connected to a wired network to enable wireless communication?
• Which term describes the individual who purchases goods or services?
• Antivirus programs must be capable of which of the following?
• Which statement best describes the scope of physical security measures for media?
• In cryptography, the one-time pad is considered unbreakable under which conditions?
• Which items are explicitly required to be included in an incident response plan?
• Which statement about wildcards in PA-DSS is true?
• How are audit trail files protected from unauthorized modifications?
• LDAP is primarily used as a repository for which type of data?
• A method to determine owner, contact information, and purpose for devices should be defined in the usage policies. Which option describes this?
• What should service providers use when remotely accessing each customer environment?
• What describes the descriptive narrative for a policy and the 'how to' for implementing the policy?
• Which practice addresses insecure communications in secure coding guidelines?
• DNS stands for Domain Name System and its primary function is to map domain names to IP addresses. Which statement best describes its role?
• To verify a sample of significant changes, which methods should be used?
• PAN display masking rule states that PAN must be masked when displayed; which is true about who can view full PAN?
• Monitoring is described as?
• Track Data in payment card transactions can refer to which of the following?
• What must be kept up to date for IDS/IPS systems?
• What is the minimum retention period for the visitor log, unless restricted by law?
• Which approach helps avoid exposing sensitive information in errors?
• Which item should be included in documented procedures for inspecting payment devices for tampering or substitution?
• What must documented approvals specify for privileged access?
• PA-QSAs are qualified by which entity to assess payment applications against PA-DSS?
• If segmentation isolates the cardholder data environment, when should penetration testing occur?
• WEP is an acronym for which phrase?
• Which option best describes the measures to address insecure crypto storage?
• What is the primary function of a Wireless Access Point?
• Which vulnerability allows unintended actions in an authenticated session due to insecure coding practices?
• What is required regarding retirement or replacement of keys when compromise is suspected?
• What best describes a Trusted Network?
• What security measure may be applied to time updates to protect them?
• Truncation is used to protect PAN when stored. True or False?
• Which report documents detailed results from a PA-DSS assessment?
• Which requirement ensures actions taken by root or administrative privileges are logged?
• Which term describes encryption that protects data during transmission and at rest?
• Buffer Overflow is defined as which of the following?
• What describes Egress Filtering?
• Which statement describes IP as the primary network-layer protocol in the Internet protocol suite?
• What weekly activity should be performed for critical files?
• Input variables help reduce rainbow table attacks.
• Which of the following is required to support detection of unauthorized access attempts?
• What does QIR stand for?
• Which term refers to network communications protocols designed to secure the transmission of data?
• Industry-tested and accepted standards include AES (128 bits and higher), RSA (2048 bits and higher), ECC (224 bits and higher). Which option best reflects this statement?
• Which term is used to describe the documentation that records an entity's compliance results against PCI DSS requirements?
• Which activity demonstrates verification of secure coding practices in a software development program?
• The process to ID security vulnerabilities should include which elements?
• Which statement about Service Providers is accurate?
• Risk ranking is defined as a defined criterion of measurement based upon the risk assessment and risk analysis performed on a given entity.
• What term describes the set of processes and mechanisms which support cryptographic key establishment and maintenance, including replacing older keys with new keys as necessary.
• Which of the following is true about key encrypting keys (KEKs) in relation to data keys?
• What is a VLAN?
• The assignment for monitoring and analyzing security alerts and distributing to appropriate information security and business unit management personnel is formally assigned to which role?
• Which option is NOT a valid form for storing crypto keys used to encrypt CHD?
• Which item is a required audit trail entry to identify the specific type of event?
• What cadence is specified for identifying and securely deleting CHD that exceeds retention?
• Which term describes disk degaussing, a process that demagnetizes the disk so data is permanently destroyed?
• Which term describes a process that includes planning, analysis, design, testing, and deployment of software?
• What is required regarding training for staff with security breach response responsibilities?
• Which concept is a discipline of math and computer science concerned with information security, particularly encryption and authentication?
• Which items must a visitor log include to document visitor access?
• What is required to ensure antivirus cannot be disabled or altered by users?
• Which resources are restricted to prevent monopolization of server resources?
• Where should audit trail files be backed up promptly to prevent alteration?
• Which term is used to describe the vulnerability that can be exploited via authenticated sessions by insecure code?
• Which of the following is NOT listed as a source of industry-accepted system hardening standards?
• Which term is Card Identification Number used on payment cards?
• How should offsite tracking logs for media be verified?
• What is required regarding test data and test accounts before production activation?
• SQL is used to create, modify, and retrieve data from which type of database management systems?
• Regarding access control, which statement is true about device and personnel authorization?
• IMAP operates at which layer of the OSI model?
• Which factor determines how often logs for all other system components should be reviewed?
• A PCI DSS policy on access control should include which of the following?
• What describes a Virtual Switch or Router?
• In authentication, a token is used to perform what kind of authentication?
• According to A.1.3, which statement about logging is correct?
• Column-Level Database Encryption refers to encryption of what?
• ROV stands for which term?
• Which statement best reflects the requirement for managing service providers under PCI DSS (Req 12.8)?
• Which statement best describes a router?
• Which term is a block of data used to encapsulate a PIN during processing?
• OWASP is best described as which of the following?
• CSRF is addressed by coding techniques that ensure applications do not rely on auth credentials and tokens automatically submitted by browsers. Which approach aligns with this guidance?
• In the PCI DSS context, which term describes an occurrence that may have security implications for a system or its environment?
• Which combination of activities is recommended to validate the existence of automated audit trails across system components?
• Which practice aligns with Req 2.2.1 to prevent co-location of functions with differing security levels on a single server?
• Which statement about Network Segmentation is true?
• What must be verified about DMZ when limiting inbound traffic?
• Which elements should be included in documented change control procedures?
• Which statement best describes explicit approval in usage policies?
• Which action reduces the attack surface of system components?
• Which acronym refers to handheld devices with capabilities such as mobile phones, e-mail, or a web browser?
• Which term refers to organization-wide rules governing acceptable use of computing resources, security practices, and operational procedures?
• DUKPT stands for Derived Unique Key Per Transaction. Which option is the correct expansion?
• A list of company-approved products should be included in usage policies. Which option is correct?
• Back out procedures should be prepared for which of the following?
• Which statement best describes the scope of procedures for user identification management?
• Which statement best describes a mainframe computer?
• What action should occur after exploitable vulnerabilities are found during penetration testing?
• In addition to assigning a unique user ID, authentication must employ at least one of which methods to authenticate all users?
• Time data protection requires which of the following?
• What best describes a Virtual Hypervisor?
• How often must internal penetration testing be performed according to PCI DSS requirements?
• Which vulnerability arises from insecure coding techniques causing improper input validation, often with CSRF and SQL injection?
• Audit Trail is another name for which record?
• What should be included in the key mgmt inventory for compliance?
• What is an Untrusted Network?
• What is the required destruction method for hard-copy materials containing CHD?
• Which statement accurately describes WPA/WPA2?
• MPLS stands for?
• PA-DSS is an acronym for what standard?
• What must be ensured regarding video cameras and access control mechanisms?
• Which term is Card Identification Number used by American Express and Discover?
• Usage policies must define acceptable uses of the technology. Which option reflects this requirement?
• Which option correctly describes where logs for external-facing technologies should be written?
• Req 2.6 Shared hosting providers must protect each entity's hosted environment and data. What must they meet?
• Under 1.1.2, what does the current network diagram document?
• The 12.3 requirement focuses on developing usage policies for what?
• To verify compliance with 1.1.1, what activity should be performed on a sample of network connections?
• What is an Index Token used for?
• PTS stands for PIN Transaction Security, a set of modular evaluation requirements for PIN acceptance POI terminals.
• Which combination of practices addresses injection flaws in software development?
• What is the purpose of a change-detection mechanism in this context?
• What best describes a VPN?
• Non-Console Administrative Access includes access from which networks?
• What should the data flow diagram show per 1.1.3?
• Cellular Technologies refer to which form of mobile communication?
• A network is defined as?
• Which action is required for inactive user accounts older than 90 days?
• Which statement about 10.1 audit trails is correct?
• Which statement best describes firewall management policy documentation?
• What is a MAC Address?
• What must all crypto key custodians formally acknowledge?
• What is the maximum idle session time before re-authentication is required?
• Which description correctly defines an IP Address?
• Which term defines a flaw or weakness that may lead to compromise if exploited?
• IMAP serves which purpose?
• Why is salt often added to hashing?
• Remote Access is defined as?
• Which statement describes a criterion for compensating controls?
• Which acronym stands for the protocol used to synchronize time across devices?
• Which networks should be monitored by IDS/IPS during security testing?
• What is a software patch?
• Which of the following are examples of open, public networks where CHD must be protected in transit?
• Column-Level Database Encryption encrypts what?
• When time settings on critical systems are changed, what process is required?
• What does 9.10 require regarding physical access to cardholder data?
• Under user authentication, which factor sets may be used to authenticate all users?
• What is required before releasing custom application code to production regarding review?
• Which techniques should address XSS vulnerabilities?
• Which term represents the organization approved by the PCI SSC to perform external vulnerability scanning?
• Which organization is a source of industry-accepted system hardening standards?
• During time settings verification, what observation indicates proper time synchronization when more than one time server exists?
• Req 3: Protect stored cardholder data. What is the main objective of this requirement?
• Structured format for organizing and maintaining easily retrievable information; simple examples are tables and spreadsheets.
• What must be maintained under Req 12.8.5 regarding assignments of PCI DSS responsibilities?
• PVV stands for PIN verification value, a discretionary value encoded in magnetic stripe of a payment card.
• What is required for security incident response and escalation procedures?
• Which expansion corresponds to the acronym PTS?
• A smart card is also known as a chip card. What does the chip contain?
• What is the primary objective of PCI DSS Requirement 1?
• What is a Web Application?
• Access privileges should be assigned based on which factors?
• NIST Special Publication 800-57 Part 1 provides guidance on cryptographic key strengths and algorithms. Which statement best describes this document?
• What is a vulnerability?
• The CERT program is associated with which organization?
• LDAP stands for?
• A Card Skimmer is best described as which?
• Which combination of verification steps is recommended during PCI DSS compliance assessment for audit trails?
• For public-facing web applications, which method is acceptable to address known attacks?
• Which is true about secure crypto key distribution?
• For first-time use and password resets, what must be done with the credentials?
• A console is defined as which of the following?
• NAT is also known as which of the following?
• Which option best represents the minimum content that must be included in an incident response plan?
• Audit trails must record the origination of an event. Which option best represents this requirement?
• Which activity should be performed to verify that keys exist in approved forms at all times?
• What should PCI DSS require to distinguish onsite personnel from visitors?
• In PCI DSS context, which statement is true about WEP?
• Backup media storage should be secured off-site, and the location's security should be reviewed how often?
• What does virtualization enable regarding virtual machines and hardware?
• In the PCI DSS context, what does the hypervisor include?
• AAA stands for what in the material?
• In network security, a DMZ provides what kind of exposure?
• The Cardholder Data Environment includes which components?
• Which statement is true about end-of-cryptoperiod changes?
• Under A.1.3, who should be able to review logs?
• What does TACACS stand for?
• Where is the service code found and what is its purpose?
• Which process identifies all system components, people, and processes to be included in a PCI DSS assessment?
• What must be true about security policies & operational procedures for protecting stored CHD?
• Under PCI DSS, anti-virus software should be actively running and cannot be disabled or altered by users unless authorized by mgmt for a limited time.
• Which option is a classic security protocol example?
• Where is a virtual switch typically located?
• Which item should be examined to verify antivirus log generation is enabled?
• Which statement best describes logging requirements for cardholder data access?
• For POS POI terminals using SSL/early TLS and asserted not susceptible to known exploits, what documentation must exist?
• How often must internal and external vulnerability scans be performed?
• Which statement best captures the requirement to restrict inbound and outbound traffic for the CDE?
• What must be verified before modifying any authentication credential via non-face-to-face method?
• Time updates should be received from which sources, and what protections might be applied?
• After significant changes, which statement best describes vulnerability scanning requirements?
• What should a firewall permit regarding inbound connections into the internal network?
• What is the focus of the testing requirement associated with change control procedures (6.4.5.3)?
• Which statement about training content for POS personnel is true?
• Which statement best describes firewall management policy documentation?
• What must be done with the information security policy to ensure it reaches relevant personnel?
• Which items are considered network components?
• How often must media inventories be performed?
• What is a proxy server?
• What events must be logged for system-level objects?
• What should be verified to ensure outbound traffic from the CDE to Internet is properly controlled?
• What should 1.1.5 include?
• What does a Network Diagram depict?
• To verify that daily review procedures exist, which documents should you examine?
• Reseller / Integrator is defined as?
• The Cardholder Data Environment (CDE) comprises which of the following?
• Which approach best ensures audit trails capture all auditable events?
• Which of the following are examples of service providers to be included in PCI DSS oversight?
• What is a Backup?
• Which action demonstrates that authentication policies are distributed and understood by users?
• Versioning Methodology is best described as?
• Which term refers to information that can be used to identify or trace an individual's identity, including name, address, and biometric data?
• 12.3.10 prohibits copying, moving, and storing CHD onto local drives and removable media unless explicitly authorized for a defined business need.
• How is an Information System best described?
• What does QSA stand for?
• Which statement is true regarding crypto architecture documentation for CHD protection?
• Which practice is required for visitors in areas where cardholder data is processed?
• For remote network access from outside the network, what is required about authentication methods?
• Network Sniffing is best described as:
• NVD stands for what in the context of vulnerability management?
• Which principle requires giving users the minimum access necessary to perform their job?
• Which of the following is a private IP address range defined by RFC 1918?
• Which of the following is an example of an operating system?
• Which method renders PAN unreadable according to policy?
• NAC in PCI DSS terminology refers to?
• What does 1.3 prohibit regarding direct public access?
• Which diagram is required to identify connections between the CDE and other networks (including wireless networks) under 1.1.2?
• Who may view audit trail files?
• Which term is a passive technique that monitors network communications and decodes protocols?
• For a sample of user IDs, which testing step verifies proper privilege enforcement?
• Masking is used when there is no business requirement to view the entire PAN. Which statement is true?
• What is the recommended basis for assigning user privileges to system components?
• Req 2.4 requires maintaining an inventory of system components. What should the inventory include?
• Which network is established and operated by a third party provider for data transmission services for the public, where data can be intercepted, modified, and/or diverted?
• In cryptography, what does MAC stand for?
• Which practice aligns with Requirement A.1.1 for shared hosting environments?
• Which acronym refers to a file-transfer protocol that encrypts authentication information and data in transit?
• Which installation practice is required for vendor defaults?
• Which statement best describes the organization’s policy on distributing media?
• Acquirer is defined as what?
• Which term describes information that can identify an individual, including name, address, SSN, and biometric data?
• Before applications become active or are released to customers, what must be done with development, test, and custom application accounts?
• How should an organization ensure the incident response plan remains current with industry developments?
• What must a risk assessment identify to be compliant?
• AP is an acronym for which device?
• What must service-provider documentation include regarding non-consumer customer passwords?
• What does S-FTP do?
• What kind of process must exist to keep the incident response plan current?
• Memory-Scraping Attacks are described as?
• The penetration testing program must specify retention of results and remediation activities. Which option best reflects this requirement?
• Which statement about secure software development is true?
• SSL stands for Secure Sockets Layer and is the predecessor to TLS. Which statement is true about SSL?
• What describes a network established by an organization that uses private IP address space and is commonly designed as a local area network?
• Who is responsible for managing and administering databases?
• Which description best defines Adware?
• What does Req 12.8.3 require before engaging any service provider?
• FTP stands for which term, and what is a key security concern associated with it?
• What describes an intrusion prevention system (IPS)?
• Which term is the formal description of how a database is constructed and organized?
• Which statement about the GSM standard is accurate?
• What is the objective of the formal security awareness program?
• System-level object refers to which of the following?
• Remote-access policies require automatic session disconnect after inactivity. Which statement matches this requirement?
• Remote Access connections can originate from where?
• Which statement accurately reflects usage of database access and application IDs?
• What type of evidence confirms that CHD in transit is encrypted during validation?
• Which of the following should be indicated in audit trails to show whether an event succeeded or failed?
• Which practice ensures wireless security after personnel changes?
• Re-keying is defined as?
• What is the primary role of a Web Server in a network?
• Which description best defines Off-the-Shelf products?
• Which term includes full-time and part-time employees, temporary workers, contractors who have access to the cardholder data environment?
• DMZ stands for Demilitarized Zone. Which statement best describes its purpose?
• To verify compliance with media inventory requirements, what should auditors review?
• Req 2.5 requires security policies for vendor defaults and other security params. What should be true about these policies?
• In security terminology, compromise is also referred to as which of the following?
• NIST stands for:
• Which statement about generation of strong crypto keys is required?
• Which policy prevents a user from choosing a new password that matches any of the last four passwords they used?
• Which statement best describes a rootkit?
• What must a written agreement with a service provider include under Req 12.8.2?
• Who should review custom code changes prior to release to production to identify potential vulnerabilities?
• When validating CHD transmission security, which configuration check is required?
• Sensitive authentication data may be transmitted or processed as part of a payment transaction, but what is the key storage rule?
• What is Encryption?
• CERT stands for which entity?
• AES stands for which phrase?
• In validating privilege enforcement, which activity is recommended?
• Which statement best describes anti-spoofing measures?
• When media is moved off-site, what shipping method requirement must be followed?
• How should physical authentication methods be handled when access is no longer needed?
• Antivirus log retention should be in accordance with which PCI DSS requirement?
• Which of the following is required by key management procedures to prevent unauthorized substitution of cryptographic keys?
• In service provider arrangements (Req 12.9), what must a service provider acknowledge in writing?
• Which device is commonly used to enforce security policies between networks?
• Which baseline setting should an access control system enforce by default to protect cardholder data?
• Which of the following is a sign of tampering or substitution on a payment device?
• Remote Lab Environment is defined as?
• Which statement about PCI DSS 6.5 is true?
• 12.3.9 activation requirement: when should remote-access technologies be activated?
• What is a hardware security module used for?
• In PCI DSS terms, masking is used for what purpose?
• Which term refers to any user account with greater than basic access privileges?
• Which describes creating and implementing applications that are resistant to tampering and compromise?
• Which statement best reflects ID controls for administration and access?
• Which protocol is used to monitor network-attached devices for administrative alerts?
• Which description best defines a server?
• SQL injection is a form of attack in which unauthorized SQL commands are executed by exploiting insecure code on a system connected to the Internet. Which option best describes this?
• The time span during which a cryptographic key can be used for its defined purpose based on time or ciphertext produced.
• Which term is an example of a server type?
• Which of the following best defines a password or passphrase?
• Which statement best describes the ongoing maintenance of time synchronization configurations under PCI DSS?
• Which term describes a collection of hardware, software, and firmware that implements cryptographic processes within a defined boundary?
• Which policy is required regarding PAN transmission via end-user messaging technologies?
• LPAR stands for which concept?
• What does LAN stand for?
• How should a shared hosting provider's protection of hosted environments be verified?
• What does the acronym PAT refer to in networking?
• In the context of PCI DSS, hashing must be applied to which data to render unreadable?
• Degaussing is also called disk degaussing and permanently destroys data on a disk. Which statement describes this process?
• Where should an automated solution that detects and prevents web-based attacks be deployed for public-facing apps?
• What is the maximum number of invalid login attempts after which a user ID should be locked out?
• Which architecture best prevents direct public access from Internet to internal cardholder network components?
• Under PCI DSS, what qualifies as a Payment Card?
• Which Appendix contains the Additional PCI DSS Requirements for Shared Hosting Providers?