[2024] Pass Key features of CPSA_P_New Course with Updated 52 Questions [Q26-Q48]

NEW QUESTION 26
For how long must a CPSA Company maintain workpapers and technical information obtained during an assessment?

Until each applicable payment brand has accepted (and signed off) the ROC and AOC

As long as the entity under assessment is a client of the CPSA Company

3 years

1 year

NEW QUESTION 27
A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

None, only people on the pre-approved list may enter

When they are approved by the physical security manager or senior management

When the third party s liability insurance covers the risk

When no card production activities are taking place

NEW QUESTION 28
A card production vendor employs a contracted guard service from an outside source. What is one of the responsibilities of the contracted service?

Provide only certified guards

Register their service with the VPA

Maintain their own liability insurance in case of losses to card material

Undergo their own Card Production assessment and provide evidence of a passing result

NEW QUESTION 29
If a vendor plans to terminate an employee, which of these must be done?

The employee must be escorted from the premises immediately

The employee’s locker and desk must be searched prior to termination

The Human Resources department must be notified prior to termination

The security manager must be notified in writing prior to termination

NEW QUESTION 30
Before you go on-site, the vendor’s primary contact communicates a legitimate reason for delaying the assessment for several months. Who can approve the change in the report delivery schedule?

Vendor senior management

Payment brands

Affected issuers

PCI SSC

NEW QUESTION 31
A vendor uses codes from a chip manufacturer to ‘unlock’ chips and prepare them for use by adding applications and keys. Which of the following best describes this process?

Data creation

Data preparation

Manufacture

Pre-personalization

NEW QUESTION 32
During an assessment you do a walk-through of bringing card products into the HSA using the goods-tools trap. You act as production staff, using an empty cardboard box as the card products. During the process, the guard escorts you, along with the box, into the pre-press room. What is your conclusion?

Compliant, because the guard escorted you

Compliant, because the guard ensured that the card product remained under dual control

Not compliant, because an inventory of the card product did not take place prior to entry

Not compliant, because the guard escorted you

Explanation
According to the PCI Card Production Physical Security Requirements, the goods-tools trap is a secure area that separates the HSA from the outside world, and is used to control the entry and exit of card products, tools, and other materials. The goods-tools trap must have two doors that are interlocked, meaning that only one door can be opened at a time. The goods-tools trap must also have a CCTV camera and an alarm system. The process of bringing card products into the HSA using the goods-tools trap must follow these steps1:
The card products must be delivered to the goods-tools trap by authorized personnel, who must present their identification to the guard and sign a delivery note.
The guard must verify the identification of the personnel and the quantity and quality of the card products, and record the details in a log.
The guard must then escort the personnel to the first door of the goods-tools trap, and open it using a key or a card reader. The personnel must place the card products inside the goods-tools trap and exit the area. The guard must then lock the first door.
The guard must then notify the production staff inside the HSA that the card products are ready to be collected. The production staff must present their identification to the guard and sign a receipt note.
The guard must then escort the production staff to the second door of the goods-tools trap, and open it using a key or a card reader. The production staff must collect the card products from the goods-tools trap and enter the HSA. The guard must then lock the second door.
In this scenario, the guard escorted the production staff, along with the box, into the pre-press room. This is not compliant, because the guard is not authorized to enter the HSA, and the card products must remain under dual control at all times. The guard should have stayed outside the HSA and only opened the second door of the goods-tools trap for the production staff. This would ensure that the card products are securely transferred from the goods-tools trap to the HSA, and that the guard does not compromise the security of the HSA.
References:
PCI Card Production Physical Security Requirements, v2.0, April 2019, page 15, requirement 2.1.1 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 16, requirement 2.1.2 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 17, requirement 2.1.3 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 18, requirement 2.1.4

NEW QUESTION 33
During an assessment you walk the perimeter of the building with a guard you find an emergency exit door from the facility and ask the guard what is on the other side. The guard can’t remember, and so uses their assigned, secure key to open the door and show you a corridor within the facility. What most concerns you about the situation?

The exit door should not lead into the facility

The exit door should not be capable of being opened from the outside

The guard should not have forgotten where the door leads to

The guard should have sought permission from their manager before opening the door

NEW QUESTION 34
Which of the following principles must be enforce by the HSA Access Control system?

Dual control

Dual presence

Dual control and dual presence

Dual guard entry when required

NEW QUESTION 35
You wish to check that you are using the most current version of the Card Production requirements. What should you do?

Have the CPSA Company’s point of contact request the document

Download it from PCI SSC’s Document Library

Email a request for the document to PCI SSC

View it directly via PCI SSC Assessor Portal

NEW QUESTION 36
A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

PCI SSC

Assessor

Issuing banks

Payment brands

NEW QUESTION 37
Which of the following statements is true about the facility’s non-emergency exits?

They must be contact-alarm monitored only when card production activities are taking place

They must be configured to prevent staff tailgating

They may be left unlocked when a guard is present

They must be fitted with biometric access-control devices

NEW QUESTION 38
Which of the following must be used by the vendor to protect doors that provide access to buildings containing air conditioning equipment?

Security tape that will leave an observable trace each time a door is opened

Electrical contacts that log each open and close event to a secure system memory

Magnetic contacts that are permanently alarmed and that are connected to the security control-room panels

Physical locks with a limited set of keys under constant supervision by a guard in the security control-room

NEW QUESTION 39
The receptionist responsible for the entrance and departure of visitors must have which of the following?

A shredder for the destruction of disposable visitor badges

A constant, open communication channel with a guard

An unobstructed view of the reception area at all times

A means of communicating directly with the visitor while on the premises

NEW QUESTION 40
If you have a query about a missing field in the card production reporting template, which organization is best-placed to answer it?

The payment brands

The vendor

The issuer

PCI SSC

NEW QUESTION 41
Which document describes the results of an assessment, and is signed by both the assessor and the vendor executive officer?

Security Assessment Questionnaire (SAQ)

Attestation of Compliance (AOC)

Report on Compliance (ROC)

Letter of Approval (LOA)

NEW QUESTION 42
How frequently must alarms on external doors of a card production and provisioning vendor environment be tested?

Every day

Every week

Every month

Every 3 months

NEW QUESTION 43
Which of the following statements about unsolicited visitors is true?

They must be turned away

They must complete an NDA before entry is granted

They must be able to prove a legitimate reason for their visit prior to entry

They must be registered, their identities confirmed, and must be allocated an escort before entry

NEW QUESTION 44
When must HSA motion detectors generate an alarm event?

Each time movement is detected

Each time movement is detected outside of regular business hours

Each time movement is detected and the access-control system indicates the room is occupied

Each time movement is detected and the access-control system indicates the room is not occupied

NEW QUESTION 45
During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Employee information, including background checks, must be stored for at least seven years

Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

The vendor must retain the background information for at least 18 months after termination of contract

The vendor must only retain background information for all current employees, not for those that have been terminated

NEW QUESTION 46
The vendor’s technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened. Why might this cause a problem for their assessment?

If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it

During working hours, the alarm should be managed in the security control room, or by a central monitoring service

If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm

During busy times, the local police may not be able to respond

Exam Dumps VCE

[2024] Pass Key features of CPSA_P_New Course with Updated 52 Questions [Q26-Q48]

Leave a Reply Cancel reply