Question 1

For how long must a CPSA Company maintain workpapers and technical information obtained during an assessment?

Options :

A : Until each applicable payment brand has accepted (and signed off) the ROC and AOC

B : As long as the entity under assessment is a client of the CPSA Company

C : 3 years

D : 1 year

Answer: C

Question 2

Which of the following events does not necessitate an audible alarm?

Options :

A : Detection of motion in the HSA when it is supposed to be unoccupied

B : Attempting to use an access badge that has been deactivated or reported stolen

C : Security control room door left open for more than 30 seconds

D : Connection loss of CCTV video feed

Answer: B

Question 3

During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Options :

A : Employee information, including background checks, must be stored for at least seven years

B : Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

C : The vendor must retain the background information for at least 18 months after termination of contract

D : The vendor must only retain background information for all current employees, not for those that have been terminated

Answer: A

Question 4

Which of the following personnel changes must result in the vendor notifying the Vendor Program Administration (VPA)?

Options :

A : Adding additional rights to someone’s role to give them access to the mam production vault

B : Any change to a role that directly affects the security of card products and related components

C : Hiring someone that will directly interact with the card issuers

D : Promoting someone to senior management levell

Answer: B

Question 5

Who is required to approve visitor entry to the HSA or cloud-based provisioning environment?

Options :

A : The head of the vendor facility

B : The Security Manager

C : Both the Security Manager and the Production Manager

D : The Security Manager, Production Manager, and the head of the vendor facility

Answer: D