Question 1

According to requirement 2.3.6.2, how long must a log of the event be maintained following the apprehension of an unauthorized individual detected by the movement detector, located inside the inner room or the shipping area, when both the intermediate and inner doors are closed and locked?

Options :

A : At least 3 years

B : Permanently

C : At least 2 years

D : Until the incident follow-up is completed

Answer: C

Question 2

A CPSA Company has submitted multiple reports that are incomplete and do not contain the information described in the reporting instructions. Which of the following are possible outcomes?

Options :

A : They may be put into remediation or revoked by the applicable payment brands

B : They may be put into remediation or revoked by PCI SSC

C : They may be fined by the applicable payment brands

D : They may be fined by PCI SSC

Answer: A

Question 3

When must HSA motion detectors generate an alarm event?

Options :

A : Each time movement is detected

B : Each time movement is detected outside of regular business hours

C : Each time movement is detected and the access-control system indicates the room is occupied

D : Each time movement is detected and the access-control system indicates the room is not occupied

Answer: D

Question 4

During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Options :

A : Employee information, including background checks, must be stored for at least seven years

B : Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

C : The vendor must retain the background information for at least 18 months after termination of contract

D : The vendor must only retain background information for all current employees, not for those that have been terminated

Answer: A

Question 5

For each requirement listed in a ROC, which types of findings must have a full narrative response?

Options :

A : All types of findings

B : Non-compliant findings only

C : New or Closed findings only

D : All types except Not Applicable findings

Answer: D