PCI Data Security Standard Practice Test

These questions are part of the practice quiz. Start practicing

• Which statement describes how time should be acquired, distributed, and stored?
• Inbound Internet traffic should be limited to IP addresses within the DMZ. Which option reflects this rule?
• Which statement best describes the goal of authentication policy documentation?
• Which statement best describes the requirement for mobile devices connecting to the network?
• What is required by documenting approvals for privileges?
• What action must be taken before applications become active or released to customers?
• When a service is considered insecure but required, what should be done?
• Which statement best describes the usage policy requirements across the seven sub-items?
• What does Requirement 10.1 require regarding audit trails?
• Which statement best describes the aim of access control for system components and cardholder data?
• Which PCI DSS requirement focuses on restricting and monitoring access to network resources and cardholder data?
• Which statement accurately reflects the handling of generic user IDs and shared IDs in system administration?
• Which statement best describes time data in the PCI DSS context?
• Which PCI DSS requirement addresses the use of unique identities and authentication methods to access system components?
• Which statement best describes when compensating controls are used in PCI DSS?
• Which of the following is a Cardholder Data element?
• Which organization examples are cited as current best practices to use for vulnerability management?
• For systems not commonly affected by malware, which action aligns with best practice regarding anti-virus applicability?
• What should be done when unauthorized wireless access points are detected?
• 12.3.4 requires?
• What must organizations maintain when dealing with service providers?
• Which PCI DSS requirement ensures that the security policy and procedures clearly define information security responsibilities for all personnel?
• What does assigning access based on job classification and function mean?
• What does PCI DSS require regarding file-integrity monitoring for logs?
• Which PCI DSS control specifies the addition, deletion, and modification of user IDs, credentials, and other identifier objects?
• What does restricting access to privileged user IDs require?
• What is the purpose of configuring system security parameters?
• Which of the following is true about firewall documentation and awareness?
• Under 6.5.1, which types of injection flaws are considered?
• Which item is considered sensitive authentication data that should not be stored after authorization?
• What does PCI DSS say about vulnerability lists 6.5.1-6.5.10 and best practices?
• Which statement correctly reflects time data handling?
• Which statement best describes controls over the distribution of media?
• What must be provided to visitors to distinguish them from onsite personnel and indicate expiration?
• What is required regarding firewall management policies?
• Which item is NOT considered Cardholder Data?
• What is the primary purpose of PCI DSS Standard 1?
• Which statement best describes PCI DSS 6.6 for public-facing web applications?
• Which of the following is listed as an example of a critical technology?
• What is the intended outcome of Requirement 7.3 in PCI DSS?
• What are the requirements for code reviews prior to release?
• Which requirement mandates providing appropriate training to staff with security breach response responsibilities?
• PCI DSS 6.5.7 identifies which vulnerability?
• Exploitable vulnerabilities found during penetration testing are corrected and testing is repeated to verify the corrections.
• Which statement best reflects malware protection policy?
• As of which date does the service provider acknowledgment requirement become mandatory?
• What is the requirement for firewall and router configurations in relation to untrusted networks?
• Which action related to audit logs is specified as needing control?
• Which PCI DSS requirement mandates regularly testing security systems and processes?
• 12.3.5 requires?
• Requirement 9.9 applies to which devices in card-present transactions?
• What separation is required between development and production environments?
• Who should have access to audit trails?
• What must be maintained for wireless infrastructure to comply with the policy?
• What is the default setting described for the access control system?
• Which requirement is explicitly described as protecting all systems against malware and regularly updating anti-virus software or programs?
• Regarding 3.6.5, what is required when keys are retired or replaced and possibly retained?
• What is true regarding public-facing web applications and controls?
• What is required about security policies and operational procedures for developing and maintaining secure systems and applications?
• When other authentication mechanisms are used, what must be ensured?
• Which statement describes vulnerability identification and risk ranking?
• Which requirement states that vendor-supplied defaults for system passwords and other security parameters must not be used?
• What documentation is required for all services, protocols, and ports allowed?
• Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.
• Which statement is NOT an acceptable form for storing secret and private keys used to encrypt/decrypt cardholder data?
• Which of the following is included in 10.2.5 regarding account management?
• Which statement best describes requirement 9.7.1 regarding media inventories?
• Which item includes sub-requirements 1.1.1 and 1.1.2?
• What should be included in personnel training about tampering and substitution?
• Before engaging service providers, 12.8.3 requires what?
• What is required regarding patching known vulnerabilities?
• Which statement best describes the requirement for critical system clocks?
• Data retention and disposal policies for cardholder data storage must include which elements?
• Which statement best describes the goal of Requirement 12.6 in PCI DSS?
• Which approach to software development security aligns with PCI DSS and industry best practice?
• Where should compensating controls be documented when used to meet a PCI DSS requirement?
• What is recommended for publicly accessible network jacks?
• Penetration testing should be conducted from which network perspectives?
• For each role, which two elements must be defined regarding access?
• Which is the focus of PCI DSS Requirement 6.5.4?
• What does it require to define access needs for each role?
• What item must be included in the alerts used by the incident response process under 12.10.5?
• Which statement describes 12.8.4's monitoring requirement?
• Which item is explicitly included in 12.10.1 as part of incident response planning?
• 12.3.3 requires?
• Which statement best describes the capabilities expected of anti-virus programs?
• Before installing a system on the network, which security practice should be performed regarding vendor defaults?
• Who must perform external vulnerability scans?
• Under PCI DSS, what is true about storing sensitive authentication data after authorization?
• Which statement describes secure software development requirements?
• For third-party repair or maintenance personnel, what action is required before granting access to devices?
• Before production systems become active, what must be done with test data and accounts?
• Which PCI DSS requirement is about establishing and implementing firewall and router configuration standards?
• Which elements may be considered when ranking vulnerabilities?
• What is the maximum number of failed login attempts allowed before a user ID is locked out?
• Can multiple scan reports be combined to show quarterly coverage?
• What must be true about compensating controls when used?
• According to 12.6, awareness methods should vary based on what?
• Which sub-requirement requires monitoring and analyzing security alerts and information, and distributing them to appropriate personnel?
• What should procedures to distinguish onsite personnel and visitors include?
• What should be done to audit trail files to prevent tampering?
• What is the primary reason to restrict access to a cardholder data environment?
• 12.3.7 requires?
• What must be in place for SSL/early TLS implementations prior to the transition date and for new implementations?
• External penetration testing must be performed at least annually and after any significant upgrades or modifications.
• Which practice is recommended when dealing with devices during maintenance?
• Which statement is correct about storing the card verification code after authorization?
• What is the maximum number of PAN digits that can be displayed, and what note applies to POS receipts?
• Which policy mandates retaining audit trail history for at least one year, with a minimum of three months immediately available for analysis?
• What is required for wireless networks in relation to the cardholder data environment?
• Which statement best describes the requirement for methods used to test for the presence of wireless access points?
• What is the main aim of restricting each entity's access to its own cardholder data environment?
• Penetration testing results and remediation activities must be retained.
• Which method is acceptable for sending media to ensure traceability?
• Which PCI DSS requirement addresses ensuring current network diagrams identify all connections between the cardholder data environment and other networks, including wireless networks?
• Which statement best describes the requirement for encrypting transmissions of cardholder data?
• Under PCI DSS 6.6, which activity is recommended to protect public-facing web applications?
• Which statement best describes the basis for temporarily disabling anti-virus protection?
• Security policies and operational procedures for security monitoring and testing must be documented, in use, and known to all affected parties.
• What is the purpose of Appendix C in the PCI DSS documentation?
• Which item is an example of improper access control?
• Which statement best describes a Service Provider?
• What must happen to access for onsite personnel upon termination?
• What does Requirement 12.1.1 require?
• Which PCI DSS requirement is associated with logging and audit trails that are unique to each entity's cardholder data environment?
• Which aspect is addressed when the access control system covers all system components?
• Which PCI DSS requirement maintains a policy that addresses information security for all personnel?
• Which statement about a visitor log is correct?
• Which PCI DSS requirement focuses on identifying and authenticating access to system components?
• Which PCI DSS requirement requires restricting physical access to cardholder data?
• Which statement best describes Requirement 3.6.2 for cryptographic keys?
• Under Appendix A.1, which statement is true about hosting providers?
• Which statement best describes the requirement for security policies and procedures to monitor access to network resources and cardholder data?
• Which of the following describes how to enable services on a system?
• Internal penetration testing must be performed at least annually and after significant upgrades or modifications.
• Which PCI DSS requirement addresses protecting stored cardholder data?
• Which statement accurately describes handling of insecure protocols in documentation?
• Under Requirement 3.5.1, how should access to cryptographic keys be restricted?
• Which statement about Service Providers is correct?
• What is the recommended approach to server roles to minimize risk?
• Which option best describes Requirement 3.6.3 for key storage?
• In wireless environments connected to the cardholder data environment, which action should be taken at installation?
• Before modifying any authentication credential (such as a password reset or token provisioning), what action must be performed?
• How should media be sent to ensure it can be accurately tracked?
• What is required for internal vulnerability scans in the quarterly cycle?
• Which term describes the mechanism to control device access to the network and cardholder data?
• What should happen to a visitor's badge or identification before leaving the facility or at expiration?
• Which set of methods may be used to detect and identify wireless devices?
• Which statement about time data is accurate?
• Which PCI DSS requirement assigns to an individual or team the information security management responsibilities?
• Which PCI DSS requirement specifies automatic disconnect of remote-access sessions after inactivity?
• After a significant change, which is required regarding scans?
• In secure coding, developers should understand how sensitive data is handled in memory. Which option reflects this statement?
• Which PCI DSS requirement states to develop and maintain secure systems and applications?
• Which requirement covers assigning information security management responsibilities to individuals or teams?
• 6.4.5.4 requires what to ensure rollback capability?
• Which statement best reflects wireless network security when transmitting cardholder data?
• How long should the visitor log be retained, unless law requires otherwise?
• What is stateful inspection in firewall filtering?
• Which constraints justify the use of compensating controls?
• Under PCI DSS, which requirement requires restricting access to cardholder data by business need to know?
• Requirement 9.9 provides protection for devices that capture card data; when did this become a formal requirement?
• Which approach is required for distributing media?
• Which of the following would be considered a time source for synchronization?
• Which statement accurately reflects the restriction on group, shared, and generic IDs?
• Which statement best describes the requirements for maintaining anti-virus mechanisms?
• How should onsite personnel access to sensitive areas be controlled?
• What is required of cryptographic key custodians under the key management requirements?
• Which PCI DSS standard is focused on maintaining a vulnerability management program?
• To safeguard sensitive cardholder data during transmission over open networks, which of the following best describes the required control?
• Who must know the security policies and operational procedures?
• Requirement 12.10.3 mandates that an organization designate personnel to be available on a 24/7 basis to respond to security alerts.
• Which option is not a required element of change control procedures for patches?
• Which statement describes restricting physical access to network devices?
• Which statement best describes the overarching requirement for protecting stored cardholder data from a policy perspective?
• Which area is considered sensitive for monitoring access under facility controls?
• Which PCI DSS requirement is explicitly cited for logging and audit trails in the context of cardholder data environments?
• When handling media, which approach aligns with securing backups?
• Which statement about time data protection is correct?
• Which item is NOT required to be included in the incident response plan under 12.10.1?
• 10.2.5 requires tracking of which items?
• What does PCI DSS Requirement 6.5.6 require you to address?
• Which statement best describes suspicious behavior around payment devices?
• What is the core principle of the access control system described as denying all by default unless allowed?
• Which option is a typical example for a time source in time synchronization?
• Who should have access to audit trails?
• What function does the Acquirer provide to merchants?
• From what source should time settings be obtained for security event logging?
• Which vulnerability type is addressed by PCI DSS Requirement 6.5.2?
• When transmitting data in transit, which statement correctly describes the requirement for encryption strength?
• Public keys do not require storage in one of these forms; which statement is true about public keys?
• According to 9.9.1, which information should be included in the device inventory?
• Change control procedures for security patches must include which element?
• What must be true about security policies and procedures for identification and authentication?
• What does Requirement 3.6.1 specifically require?
• How often must the incident response plan be tested?
• What is the purpose of maintaining a visitor log in this context?
• As part of change control, what is required for approvals?
• Which requirement prohibits copying, moving, and storing cardholder data onto local drives and removable media unless explicitly authorized for a defined business need?
• The incident response plan must cover which of the following components?
• Which sub-requirement requires establishing, documenting, and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations?
• What is the primary purpose of implementing a DMZ in a network security architecture?
• Two-factor authentication is required for remote network access from outside the network by personnel and all third parties.
• In the context of hosted merchants or service providers, what process should be enabled to support investigations?
• What is the required minimum lockout duration, or when must an administrator re-enable a locked account?
• According to the password policy, what is the minimum length and character requirement for passwords?
• Where should system components that store cardholder data be placed?
• What should be described for network management responsibilities?
• Which tools may be used to meet Requirement 10.6?
• Which activity concerning system-level objects must be auditable?
• Which type of data is categorized as Sensitive Authentication Data?
• Where should perimeter firewalls be installed in relation to wireless networks?
• For wireless environments connected to the cardholder data environment, what action is required at installation?
• Which requirement governs activation of remote-access technologies for vendors and business partners only when needed by vendors and business partners, with immediate deactivation after use?
• What is the minimum password change interval?
• Under PCI DSS 6.5, which action is required to address vulnerabilities?
• Which statement best describes vendor remote access controls under PCI DSS?
• What is the purpose of having a current diagram of cardholder data flows?
• Which describes the due diligence before engaging service providers?
• Which PCI DSS requirement focuses on implementing an incident response plan to respond to a system breach?
• Which statement best describes the relationship between key-management procedures and encryption of cardholder data?
• What policy describes outbound CHD traffic to the Internet?
• Which statement is correct about annual acknowledgment under 12.6.2?
• Which responsibility is associated with an Acquirer?
• Use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network. Monitor all traffic at the perimeter and critical points in the CDE, and alert personnel to suspected compromises. Keep IDS/IPS engines, baselines, and signatures up to date.
• Which statement best describes the PCI DSS requirement for security policies related to vendor defaults and other security parameters?
• What must be done with development, test, and custom application accounts before activation?
• Which Appendix name discusses compensating controls in PCI DSS?
• 6.4.5.3 requires what for changes?
• Which statement about data retention and secure deletion is correct?
• Which option represents the requirement for authentication for use of the technology?
• Which PCI DSS requirement restricts access to cardholder data by business need to know?
• Improper error handling can lead to which risk?
• Which statement accurately reflects SSL and early TLS policy after the transition date?
• Which requirement requires management approval for any and all media moved from a secured area?
• Which action satisfies requirement 9.8.2 for electronic media?
• What does requirement say about storing media backups regarding location and security review?
• What must each entity ensure regarding processes and access to cardholder data environment under A.1.1?
• Testing must validate segmentation and scope-reduction controls. Which statement is true?
• After a significant network change, which statement is true about scanning?
• Which statement is true about database application IDs?
• What should be developed for all system components to address vulnerabilities and align with industry-accepted hardening standards?
• Which risk assessment methodologies are provided as examples?
• Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?
• What does requirement 1.2.1 specify about inbound and outbound traffic?
• If segmentation isolates the CDE, penetration tests must be performed at least annually and after changes to segmentation controls to verify segmentation methods are operational and isolate out-of-scope systems.
• Which statement is accurate about 12.8.5's requirement?
• What migration planning requirement applied to SSL or early TLS implementations is true for prior to the specified date?
• Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?
• Which PCI DSS requirement covers developing and maintaining secure systems and applications?
• During initial PCI DSS compliance, which statement about quarterly vulnerability scans is true?
• Which term refers to the person who holds the payment card and initiates a purchase?
• What should be done with router configuration files?
• Under the form requirements for storing secret and private keys, which method is acceptable for protecting keys used to encrypt/decrypt cardholder data?
• Which PCI DSS requirement covers encrypting transmission of cardholder data across open, public networks?
• Which sub-requirement enumerates the need for a formal process for approving and testing network connections and changes to firewall configurations?
• What does 3.6.6 require if manual clear-text key-management operations are used?
• 12.3.1 requires?
• Inbound Internet traffic should be limited to IP addresses within which zone?
• Which statement about keys for stored cardholder data is true?
• Application-layer penetration tests should address which of the following?
• Which role processes a merchant's payment card transactions and forwards authorization requests to the Issuer?
• Which PCI DSS requirement includes a sub-requirement that specifies a formal process for approving and testing all network connections and changes to the firewall and router configurations?
• What is the requirement for service providers that have remote access to customer premises?
• Which timing requirement applies to removing or disabling inactive user accounts?
• Which statement best describes audit trail security under these requirements?
• Which action should be taken immediately for any terminated users?
• Which PCI DSS requirement emphasizes documenting security policies and procedures for restricting access to cardholder data?
• Which PCI DSS requirement involves regularly testing security systems and processes?
• Which information should be maintained about service providers under 12.8.5?
• Which statement best describes the intent of Requirement 3.6 (key-management processes)?
• Two-factor authentication examples include which option?
• Under PCI requirements, which statement best describes the policy for restricting physical access to cardholder data?
• The penetration testing methodology should be based on an industry-accepted approach such as which of the following?
• What is required regarding access to audit trails?
• Two-factor authentication requires two of the three methods. Which statement is true?
• Which statement best describes the purpose of audit trails under PCI DS?
• If there is an authorized business need to access cardholder data via remote-access technologies, what must the usage policies require?
• How often must firewall and router rule sets be reviewed?
• Which sub-requirement comprises PCI DSS Requirement 1.1?
• How often must personnel be educated under 12.6.1?
• What condition should apply to new data added to logs when monitoring integrity?
• Which technology is an example of time synchronization used for acquiring, distributing, and storing time?
• Which option specifies the acceptable network locations for the technologies?
• Which PCI DSS requirement identifies and authenticates access to system components?
• What must be tested for on a quarterly basis to manage wireless security?
• What does the assignment of privileges to individuals based on job classification and function imply?
• Which statement is accurate about the allocation of PCI DSS responsibilities under 12.8.5?
• Which signs indicate that a device may have been tampered with or substituted?
• What is the default behavior of the access control system in terms of allowing access?
• Which Appendix provides a worksheet for defining compensating controls?
• Which security function logs are included for daily review under 10.6.1?
• What is the primary purpose of time synchronization in PCI DSS context?
• Which event types must be collected and monitored as part of audit trails?
• Which statement best describes the purpose of classifying media?
• What process should be followed for changes to system components?
• Which items must be included in an up-to-date list of devices per 9.9.1?
• Which of the following is a Payment Brand example?
• In PCI DSS terminology, what does the term 'cardholder data environment' describe?
• Which statement about time synchronization across critical systems is true?
• Which statement describes facility entry controls for the cardholder data environment?
• How often must you monitor service providers' PCI DSS compliance status?
• Which statement best represents a time data management requirement under PCI DSS?
• Periodic review of all other components should be based on what?
• According to requirement 9.8, when should media be destroyed?
• If disk encryption is used instead of file- or column-level encryption, how should logical access and decryption keys be handled?
• PCI DSS 6.5.9 covers which threat?
• Which statement accurately describes the policy for visitors entering areas where cardholder data is processed?
• Which PCI DSS item requires a current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks?
• What is a direct outcome of proper time synchronization across critical systems?
• Which practice best aligns with Requirement 3.5.3 for cryptographic keys?
• Which statement best describes the service provider acknowledgment required by PCI DSS Requirement 12.9?
• What should you do with the initial credentials assigned to a user or after a reset?
• Which statement reflects requirement 9.8.1 regarding hard-copy materials?
• Which diagram must exist to map cardholder data flows across systems and networks?
• Which PCI DSS requirement focuses on proper user identification management for non-consumer users and administrators on all system components?
• What is the stated policy for limiting repeated access attempts before a lockout occurs?
• Which technology is listed as an example of two-factor authentication?
• What is the purpose of classifying media in terms of data handling?
• Which statement correctly describes the status of SSL and early TLS with respect to strong cryptography after 2016?
• Which requirement specifies maintaining strict control over the storage and accessibility of media?
• External vulnerability scans must be performed quarterly by which type of vendor?
• Which practice is required for first-time use credentials or after resets?
• Which statement about encryption keys and key-encrypting keys is correct?
• Which PCI DSS requirement covers protecting all systems against malware and regularly updating anti-virus software?
• Network-layer tests must include components that support network functions as well as operating systems.
• Which document details the additional PCI DSS requirements for Shared Hosting Providers?
• Which action is a PCI DSS Standard 1 requirement?
• Which device is explicitly cited as a secure cryptographic device for key storage?
• What is the purpose of 12.10.6 in PCI DSS?
• Which statement best describes anti-spoofing measures?
• The service provider acknowledgement requirement may be satisfied by:
• Where should anti-virus software be deployed according to the practice guidelines?
• Under 10.2.1, which events must be captured by automated audit trails?
• Which PCI DSS standard is primarily concerned with regularly monitoring and testing networks?
• What should be reviewed to identify anomalies or suspicious activity?
• What is the policy regarding reusing previous passwords?
• What should happen to a user ID when access is no longer required due to termination or role change?
• What should enforcement of onsite personnel and visitor identification procedures include?
• Which entity issues payment cards on behalf of a Payment Brand?
• Do not disclose private IP addresses and routing information to unauthorized parties.
• How often must passwords be changed?
• Deploy a change-detection mechanism to alert unauthorized modification of critical files, with weekly comparisons.
• Which sub-requirement focuses on monitoring and controlling all access to data?
• What does PCI require for monitoring access to sensitive areas under 9.1.1?
• Which actions require audit trail coverage according to 10.2.2?
• What does requirement 1.3 prohibit?
• Penetration testing must review threats and vulnerabilities experienced in the last 12 months.
• Which statement matches the anti-spoofing example described in the requirements?
• Which PCI DSS requirement requires maintaining a policy that addresses information security for all personnel?
• If both hashed and truncated versions of the same PAN exist in an entity's environment, what must be in place?
• For systems not commonly affected by malicious software, what is required regarding anti-virus applicability?
• Which is NOT listed as an example of critical technologies?
• Which element must be included in usage policies?
• How is an untrusted network defined in this context?
• What does 12.7 require regarding screening before hire?
• Which requirement governs the control over the addition, deletion, and modification of user IDs, credentials, and other identifier objects?
• Which term describes an organization that accepts the payment card for payment during a purchase?
• Which vulnerability type is described as enabling attacker-executed scripts within a user's browser?
• On which date did broken authentication and session management become a formal requirement?
• Time data must be protected; which option best reflects this requirement?
• Which PCI DSS requirement requires assigning all users a unique ID before accessing system components or cardholder data?
• Shared hosting providers must protect each entity's hosted environment and cardholder data and meet Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers. Which option correctly reflects this obligation?
• Which statement reflects PCI DSS requirement 6.4.3 about using production data for testing?
• Which statement about magnetic stripe data retention after authorization is true?
• Which is an explicit example of time synchronization technology?
• Which sub-requirement concerns administering user accounts, including additions, deletions, and modifications?
• How should non-console administrative access be protected?
• Penetration testing scope must cover which of the following?
• In PCI DS, what is required for documentation and communication of physical access policies?
• Which statement describes how access should be assigned with respect to job role and minimal privileges?
• Which practice describes Requirement 6.4.2 in PCI DSS?
• Masking PAN when displayed is implemented; which is true?
• How should authentication credentials be protected during transmission and storage according to the policy?
• Which of the following should be included in a service provider written agreement under 12.8.2?
• Which PCI DSS requirement restricts physical access to cardholder data?
• Which items are examples of insecure services, protocols, or ports?
• A risk assessment must identify which elements?
• Which process should be enabled to support timely forensic investigation in the event of a compromise?
• Where should logs for external-facing technologies be written?
• What is the retention requirement for video security data collected under facility monitoring?
• Which requirement ensures information security responsibilities are defined for all personnel?
• What is required regarding vendor-supplied defaults and unnecessary default accounts before installing a system?
• Which practice helps ensure separation of duties between development and production environments?
• Which practice obscures IP addressing as part of network security controls?
• Which statement best describes the requirement for security policies and procedures protecting stored cardholder data?
• Where should system components that store cardholder data be placed in relation to network zones?
• Which action helps reduce the attack surface by removing unnecessary functionality?
• Which statement best describes the Issuer?
• Which PCI DSS sub-requirement directs monitoring and distribution of security alerts to the appropriate personnel?
• Which sources are commonly cited as industry-accepted system hardening standards?
• Which vulnerability is described by PCI DSS Requirement 6.5.5?
• Under what conditions may compensating controls be considered for PCI DSS requirements?
• Which issue is covered by PCI DSS Requirement 6.5.3?
• What must be documented to specify privileges granted to a user?
• Where can organizations find standards for key-management practices, such as guidance from NIST?
• As of June 30, 2015, which vulnerability becomes a formal requirement?
• Which option is used to verify that a change does not adversely impact security?
• What is required for access to the cardholder data environment in relation to job function and termination?
• If a session is idle for more than 15 minutes, what should happen?
• How should vendor IDs be managed when vendors need remote access to system components?
• Within the incident response plan, which party must be notified at a minimum?
• PCI DSS 6.5.8 addresses which security issue?
• For Requirement 12.2, how often is risk assessment performed and when else?
• Which PCI DSS requirement tracks and monitors all access to network resources and cardholder data?
• In which scenario is background screening considered a recommendation rather than a requirement?
• What is the primary purpose of audit trails?
• What must PCI DSS require regarding inventory of system components?
• Which action is explicitly associated with the audit logs and should be controlled?
• Requirement 10.2 mandates:
• What does emphasis on storage location and annual review of media backups imply?
• Which statement about vulnerability risk rankings is true?
• Which PCI DSS requirement specifically requires installing and maintaining a firewall configuration to protect cardholder data?
• Under 3.6.4, when should cryptographic keys be changed?
• What is the primary objective of the requirement to prevent unauthorized substitution of cryptographic keys?
• Where should audit trail files be backed up?
• What must be reviewed at least daily under 10.6.1?