Question 1

Which of the following is NOT a principle of the PCI DSS?

Options :

A : Regularly monitoring and testing networks to ensure security controls remain effective

B : Implementing access controls to restrict cardholder data access on a "need-to-know" basis

C : Using proprietary encryption algorithms for securing cardholder data

D : Protecting cardholder data during transmission over open, public networks through strong cryptography

Answer: C

Question 2

What is an 'inactive user account'?

Options :

A : An account that has only been used once over the course of 90 days

B : An account that is used by a current employee for a particular task

C : An account that has not been used in over 30 days

D : An account that has not been used in over 90 days

Answer: D

Question 3

Which of these should be secured as per requirement 1.2.8?

Options :

A : All staff passwords

B : A note on top of NSCs that says "Do not touch"

C : Any file or setting used to configure NSCs

D : Vendor guidance for configuring firewalls

Answer: C

Question 4

Requirement 6.5.2 dictates what?

Options :

A : All payment page scripts that are loaded and executed in the consumer’s browser are managed as follows

B : Upon completion of a significant change, all applicable PCI DSS requirements are confirmed to be in place on all new or changed systems and networks, and documentation is updated as applicable

C : Changes to all system components in the production environment are made according to established procedures that include

D : For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks

Answer: B

Question 5

Which of the following is NOT typically considered a critical component of a comprehensive incident response plan for PCI DSS compliance?

Options :

A : Providing public notifications for all security incidents involving payment card data

B : Documenting procedures for incident reporting, investigation, and remediation

C : Establishing clear roles and responsibilities for incident response team members

D : Implementing measures for timely detection and containment of security incidents

Answer: A