Regular Free Updates Assessor_New_V4 Dumps Real Exam Questions Test Engine Dec 29, 2023 [Q28-Q51]

NO.28 Could an entity use both the Customized Approach and the Defined Approach to meet the same requirement?

No because a single approach must be selected

No. because only compensating controls can be used with the Defined Approach

Yes if the entity uses no compensating controls

Yes if the entity is eligible to use both approaches

NO.29 An entity is using custom software in their CDE.The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard.What impact will this have on the entity’s PCI DSS assessment?

It automatically makes an entity PCI DSS compliant

It may help the entity to meet several requirements in Requirement 6.

There is no impact to the entity

The custom software can be excluded from the PCI DSS assessment

NO.30 If disk encryption is used to protect account data what requirement should be met for the disk encryption solution?

Access to the disk encryption must be managed independently of the operating system access control mechanisms

The disk encryption system must use the same user account authenticator as the operating system

The decryption keys must be associated with the local user account database

The decryption keys must be stored within the local user account database

NO.31 Which of the following is required to be included in an incident response plan?

Procedures for notifying PCI SSC of the security incident

Procedures for responding to the detection of unauthorized wireless access points

Procedures for securely deleting incident response records immediately upon resolution of the incident

Procedures forlaunching a reverse-attack on the individual(s) responsible for the security incident

NO.32 What process is requited by PCI DSS (or protecting card-reading devices at the point-of-sale?

Devices are periodically inspected to detect unauthorized card stammers.

The serial number of each device is periodically verified with the device manufacturer

Device identifiers and security labels are periodically replaced

Devices are physically destroyed if there is suspicion of compromise

NO.33 Assigning a unique ID to each person is intended to ensure?

Strong passwords are used for each user account

Shared accounts are only used by administrators

Individual users are accountable for their own actions

Access is assigned to group accounts based on need-to-know

NO.34 Viewing of audit log files should be limited to?

Individuals who performed the logged activity

Individuals with read/write access

Individuals with administrator privileges

Individuals with a job-related need

NO.35 Which of the following can be sampled for testing during a PCI DSS assessment?

PCI DSS requirements and testing procedures.

Compensating controls

Business facilities and system components

Security policies and procedures

NO.36 In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place”?

Details of the entity s project plan for implementing the requirement

Details of how the assessor observed the entity s systems were compliant with the requirement

Details of the entity s reason for not implementing the requirement

Details of how the assessor observed the entity s systems were not compliant with the requirement

NO.37 Which statement about the Attestation of Compliance (AOC) is correct?

There are different AOC templates for service providers and merchants

The AOC must be signed by both the merchant/service provider and by PCI SSC

The same AOC template is used for ROCs and SAQs

The AOC must be signed by either the merchant service provider or the QSA’ISA

NO.38 A sample of business facilities is reviewed during the PCI DSS assessment What is the assessor required to validate about the sample?

It includes a consistent set of facilities that are reviewed for all assessments.

The number of facilities in the sample is at least 10 percent of the total number of facilities

Every facility where cardholder data is stored is reviewed

All types and locations of facilities are represented

NO.39 Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

Each internal system is configured to be its own time server.

Access to time configuration settings is available to all users of the system.

Central time servers receive time signals from specific, approved external sources

Each internal system peersdirectorywith an external source to ensure accuracy of time updates

NO.40 Which statement about PAN is true?

It must be protected with strong cryptography for transmission over private wireless networks

It must be protected with strong cryptography (or transmission over private wired networks

It does not require protection for transmission over public wireless networks

It does not require protection for transmission over public wired networks

NO.41 What do PCI DSS requirements for protecting cryptographic keys include?

Public keys must be encrypted with a key-encrypting key.

Data-encrypting keys must be stronger than the key-encrypting key that protects it.

Private or secret keys must be encrypted, stored within an SCD or stored as key components

Key-encrypting keys and data-encrypting keys must be assigned to the same key custodian

NO.42 Which of the following describes the intent of installing one primary function per server?

To allow functions with different security levels to be implemented on the same server

To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server

To allow higher-security functions to protect lower-security functions installed on the same server

To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

NO.43 An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are logged so they can be retrieved when the employee leaves the company

Change control processes are in place to ensue certificates are changed every 90 days

Certificates are assigned only to administrative groups and not to regular users

A different certificate is assigned to each individual user account, and certificates are not shared

NO.44 Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?

The retired key must not be used for encryption operations

Cryptographic key components from the retired key must be retained for 3 months before disposal

A new key custodian must be assigned

All data encrypted under the retired key must be securely destroyed

NO.45 A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?

Remove the default ‘Firewall Administrator account and create a shared account for firewall administrators to use.

Configure the firewall to permit all traffic until additional rules are defined

Synchronize the firewall rules with the other firewalls m the environment

Disable any firewall functions that are not needed in production

NO.46 Which of the following parties is responsible for completion of the Controls Matrix to* the Customized Approach?

Only a Qualified Security Assessor (QSA)

EitheraQSA,AQSA,orPClP.

Entity being assessed

Card brands or acquirer

NO.47 H an entity shares cardholder data with a TPSP, what activity is the entity required to perform’?

The entity must conduct ASV scans on the TPSP’s systems at least annually

The entity must perform a risk assessment of the TPSP’s environment at least quarterly.

The entity must test the TPSP’s incident response plan at least quarterly

The entity must monitor the TPSP’s PCI DSS compliance status at least annually

NO.48 What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?

The security protocol is configured to support earlier versions

The PAN is encrypted with strong cryptography

The security protocol is configured to accept all digital certificates

The PAN is securely deleted once the transmission has been sent

NO.49 Which of the following types of events is required to be logged?

All use of end-user messaging technologies

All access to external web sites

All access to all audit trails

All network transmissions

NO.50 Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or intrusion protection systems (IDS’IPS)?

Intrusion detection techniques are required on all system components

Intrusion detection techniques are required to alert personnel of suspected compromises

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data

NO.51 According torequirement 1,what is the purpose of “Network Security Controls?

Manage anti-malware throughout the CDE.

Control network traffic between two or more logical or physical network segments.

Discover vulnerabilities and rank them

Encrypt PAN when stored

Exam Dumps VCE

Regular Free Updates Assessor_New_V4 Dumps Real Exam Questions Test Engine Dec 29, 2023 [Q28-Q51]

Leave a Reply Cancel reply