Question 1

An organization has multiple business locations, each with its own payment processing setup. Some locations process card-present transactions using point-of-sale (POS) terminals, while others handle e-commerce transactions through their website. As a PCI Professional, which Self-Assessment Questionnaire (SAQ) would be most appropriate for the organization's overall PCI DSS compliance assessment?

Options :

A : SAQ B

B : SAQ A-EP

C : SAQ D

D : SAQ P2PE

Answer: C

Question 2

Who is the most recent payment brand?

Options :

A : Visa

B : Union Pay

C : Mastercard

D : JCB International

Answer: B

Question 3

You have just had an external scan performed and have been told you have 2 vulnerabilities that have been scored as medium. What should be done next?

Options :

A : The vulnerabilities should be remediated and another external scan should be completed

B : Nothing has to be remediated since the vulnerability is not high or critical

C : PCI DSS version 4 only requires internal scans for compliance. External scans are an optional area to improve security posture

D : The vulnerability should be marked as a false positive and the scan result should be added to documentation

Answer: A

Question 4

Unauthorised changes on payment pages should be protected by a change and tamper detection mechanism. How often should these mechanisms be performed?

Options :

A : Every day

B : Every 7 days or periodically defined in requirement 12.3.1

C : Every 7 days

D : Based on what is periodically defined in requirement 12.3.1

Answer: B

Question 5

All internal scanning must be what?

Options :

A : Performed monthly

B : Require an ASV for internal scanning to match external scanning

C : Performed via authenticated scanning

D : Performed via unauthenticated scanning

Answer: C