PCI Fundamentals Practice Test

These questions are part of the practice quiz. Start practicing

• SAQs are validation tools intended to assist merchants and service providers in self-evaluating their PCI DSS compliance.
• Differentiate vulnerability scanning from penetration testing.
• Name a notable change introduced in PCI DSS version 4.0.
• To meet PCI DSS 1.2.1, installing a network firewall between the CDE and corporate network is an example of what security concept?
• Which statement is true about PA-DSS in relation to PCI DSS assessments?
• What is the purpose of quarterly external vulnerability scanning in PCI DSS?
• How often must external penetration testing be performed under PCI DSS?
• A partially outsourced E-commerce Merchant using a Third-Party Website for Payment Processing should use which SAQ?
• Are CVV/CVV2/PIN considered CHD under PCI DSS if stored?
• Which PCI DSS requirement focuses on firewall configuration to protect CHD, and what is a key control?
• In PCI DSS, which environment commonly uses point-to-point encryption to reduce exposure of CHD?
• Who produces the ROC in PCI DSS assessments?
• Which statement is true about flat networks in PCI DSS scoping?
• What does SAQ stand for?
• Are merchants obligated to report data breaches to card brands and customers?
• The purpose of a Qualified Integrator and Reseller (QIR) reseller does not include:
• PCI DSS is not applicable to:
• Which Scoping concept does not apply?
• Which element is essential in an asset inventory for risk management in the cardholder data environment?
• Which standards govern encryption of cardholder data in transit and what minimum version should be used?
• A Risk Analysis / Risk Assessment is:
• A PA-DSS application installed by a QIR must still be reviewed during the PCI DSS assessment.
• Which SAQ would a service provider with no electronic CHD storage most likely complete, according to the material?
• When creating an asset inventory of the cardholder data environment, ISAs' should include:
• Which statement about scoping in a PCI DSS assessment is true?
• What is the requirement for unique IDs and access auditing?
• This is Hardware and/or software used to process payment card transactions at merchant locations:
• What is the primary objective of PCI DSS?
• Which statement about open networks is true?
• Which statement correctly identifies the relationship between scoping and network segmentation?
• Which statement best aligns with proper PCI DSS scoping practice?
• Under PCI DSS version 3.2.1, MFA for non-console access into the CDE for administrative personnel is still required.
• In accordance with PCI DSS Requirement 1, firewalls are required to separate what?
• Which PCI DSS requirement is about protecting stored CHD?
• What PCI DSS controls apply to wireless networks that carry CHD?
• Which item is included in the assessment kickoff phase?
• Which merchant environment could be eligible for SAQ B?
• What is the best practice for handling cardholder data (CHD) retention?
• Which statement about user accountability is true?
• Which statement about compensating controls is true?
• Authentication refers to:
• Which activity is typically part of evidence collection in a PCI DSS assessment?
• Which statement correctly identifies the cardholder data environment (CDE) boundary?
• Which statement describes compensating controls in PCI DSS context?
• Sensitive Authentication Data (includes the full track contents of the magnetic stripe or equivalent data on a chip, card verification codes and values, PINs, and PIN blocks) should never:
• This SAQ should be used for Merchants with Standalone, IP-Connected PTS Point-of-Interaction (POI) Terminals - No Electronic Cardholder Data Storage.
• PCI SSC Community Meetings: What is their purpose?
• Which of the following is true regarding an entity sharing cardholder data with a service provider?
• What is the difference between tokenization and encryption?
• Which statement best describes the role of network protocols TLS, IPsec, SSH, and HTTPS?
• What is the purpose of the Data Flow Diagram in PCI DSS context?
• A compensating control is used when:
• Who determines merchant levels in PCI DSS context?
• This can be the magnetic-stripe image on a chip or the data on the track 1 and/or track 2 portion of the magnetic stripe:
• In PCI DSS terms, what is the cardholder environment?
• What does ECC stand for in cryptography?
• The determination of merchant levels is typically performed by:
• Which statement best describes the difference between Cardholder Data (CHD) and Sensitive Authentication Data (SAD) under PCI DSS?
• The Mod 10 test is a definitive guarantee of a valid PAN. True or False?
• What is the effect of network segmentation on PCI DSS scope?
• Regarding Track data: Track 1 contains all Track 2 data and additional fields for use by the card issuer.
• Which of the following is true about the PCI DSS SAQ usage?
• In payment card processing, a Merchant Bank is commonly called what?
• Which party is responsible for merchant compliance validation and merchant communications?
• What does QIR stand for in the PCI context?
• Which PCI DSS requirement relates to restricting access to cardholder data by business need to know?
• Which PCI DSS requirement focuses on encryption of CHD across open networks?
• Which term defines the environment that contains all systems storing, processing, or transmitting cardholder data?
• GPRS refers to which of the following?
• Under PCI DSS assessment procedures, who produces the ROC?
• Which of the following describes a poor scoping decision?
• What is Point-to-Point Encryption (P2PE) and how does it affect PCI DSS scope?
• What does PCI DSS require regarding vendor-default passwords?
• What does 'Do not use vendor defaults' address?
• What is tokenization and how does it affect card data handling?
• How does PCI DSS address third-party service providers and what documents govern their compliance?
• Systems that commonly store track data are:
• Which outcome is associated with network segmentation in PCI DSS?
• Which SAQ categories are explicitly mentioned in the material as part of PCI self-assessment options?
• What is sensitive authentication data (SAD) and can it be stored post-authorization?
• Storing full track data after authorization is permitted under which circumstances?
• Define the Cardholder Data Environment (CDE).
• Sensitive Authentication Data includes which items?
• If a suspected card account number passes the Mod 10 (Luhn) test, what does that indicate?
• Strong access control lists include the following: Do not allow 'risky' protocols such as FTP or Telnet.
• Which approach best demonstrates independent judgment during PCI DSS assessment?
• When selecting an SAQ for a service provider, which statement is accurate?
• What is the primary purpose of segmentation in PCI DSS?
• Compensating controls may be considered when an entity cannot meet a requirement explicitly as stated, due to legitimate technical or documented business constraints, but has sufficiently mitigated the risk associated with the requirement through implementation of other controls.
• Are VPNs considered open networks under PCI DSS when protecting CHD?
• Outline the high-level steps of a PCI DSS-compliant incident response process.
• Which is not one of the six primary security goals of PCI DSS?
• A poor scoping decision is most closely described as excluding part of the network from PCI DSS scope due to inadequate segmentation that was not verified to be effective. Which of the following best reflects this concept?
• What is the primary purpose of data flow mapping in PCI scope determination?
• Which statement correctly differentiates tokenization from encryption?
• The role of the Internal Security Assessor (ISA) does not include which task?
• A Card Verification Code or Value:
• Transaction volume for merchants is determined by whom?
• Which statement best describes the relationship between Track 1 and Track 2 on the magnetic stripe?
• After a significant change to the CDE, which statement is true?
• Typically, accounts with elevated privileges have more rights than a standard user account:
• Which of the following is a standard example of PAN masking for display?
• Who should receive the completed SAQ?
• Which firewall capability enhances security by tracking the state of network connections?
• Which encryption standard is recommended for data at rest containing cardholder data?
• What are the requirements for protecting log data and reviewing logs?
• How should the PAN be displayed to operators to minimize exposure?
• In risk assessment, what is the primary purpose of the process?
• Hashing in PCI DSS context: hashing must be applied to the entire PAN for the hash code to be considered rendered unreadable.
• Account Data Includes:
• Which data elements are considered cardholder data (CHD) under PCI DSS?
• Which PCI DSS requirement concerns keeping anti-virus software up to date and protecting against malware?
• What is the primary purpose of network segmentation in PCI DSS?
• What is essential when encryption is used for cardholder data at rest?
• The SAQ type referenced for service providers relates to which scope?
• In a validated P2PE deployment, which party is responsible for PCI DSS compliance by the merchant?
• Merchant levels are determined by which entity?
• Who is typically responsible for penalties for PCI DSS non-compliance?
• What does the principle of least privilege mean in PCI DSS, and which example illustrates it?
• What physical controls are required for CHD access?
• What does HSM stand for, in the context of PCI DSS?
• The PCI DSS Self-Assessment Questionnaires (SAQs) are validation tools intended to assist merchants and service providers in self-evaluating their compliance with the PCI DSS.
• What is the proper approach to encryption keys at end-of-life or decommissioning?
• With respect to Requirement 11.2, when working with an approved scanning vendor, an ISA must:
• What is the typical minimum log retention period required by PCI DSS?
• When CHD is transmitted over open networks, what is required?
• What does SAQ stand for, and why are different SAQs used?
• The Mod 10 formula doubles the value of alternate digits of the primary account number beginning with which digit?
• WhichSAQ is used for card-not-present merchants where all cardholder data functions are fully outsourced?
• Which SAQ should be used for service providers generally?
• Who signs the Attestation of Compliance?
• Which elements are considered CHD under PCI DSS?
• The payment card brands are responsible for which of the following?
• Open networks are networks not controlled by the organization (e.g., the Internet). How should CHD be transmitted across such networks?
• If sampling is used in a PCI DSS assessment, the sample must be representative of:
• Default Accounts are:
• Which SAQ should be used for Merchants with Payment Application Systems Connected to the Internet and No Electronic Cardholder Data Storage?
• When changing the cardholder data environment, which process must be included?
• Which of the following is a core element of an incident response plan?
• Which of the following best describes Removable Electronic Media?
• Documents for PCI DSS Self-Assessment does not include:
• Which description best fits the Data Flow Diagram's role in PCI DSS?
• Compensating Controls can be documented in which section of the SAQ?
• Which statement best describes the Cardholder Data Environment (CDE)?
• Which of the following is NOT considered removable electronic media?
• SAQ A-EP is used for which scenario?
• CD-ROM, DVD-ROM, USB flash drives and external/portable hard drives are examples of:
• Which statement best describes Track 1 data in relation to Track 2 data?
• Choose the best Card processing authorization flow:
• PA-DSS is applicable to:
• After completing a significant change, all relevant PCI DSS requirements must be implemented on all new or changed systems and networks:
• When assessing if cardholder data should be stored, which should not be considered?
• In PCI DSS, how do card-present and card-not-present environments differ in scope and controls?
• This SAQ should be used for all other SAQ-Eligible Merchants:
• A common error in scoping a PCI DSS assessment includes:
• What is an Attestation of Compliance (AOC)?
• When responding to an SAQ question about requirements met with compensating controls, you should check the YES with CCW column.
• Who produces the SAQ in PCI DSS assessments?
• FTP, Telnet, POP3, IMAP, and SNMP v1 and v2 are considered:
• What triggers breach notification under PCI DSS?
• Which statement about network segmentation is true?
• Which statement correctly summarizes patch timing for critical updates under PCI DSS?
• If a merchant uses a validated P2PE solution, who is responsible for PCI DSS compliance in the merchant's environment?
• Under PCI DSS, when is multi-factor authentication required?
• Which PCI DSS requirement concerns restricting access to CHD by business need?
• It is permissible to store track data only if:
• A service provider with no electronic cardholder data storage may be eligible to complete which SAQ?
• When must external penetration testing be performed according to PCI DSS?
• Which statement best describes training requirements for personnel under PCI DSS?
• How often should firewall and router rule sets be reviewed?
• Which SAQ type is specified for eligible service providers?
• True statement about segmentation and CHD environments?
• Why is change management important in PCI DSS and what should be included?
• Which aspect is not required of an ISA under PCI DSS?
• During a PCI DSS assessment, assessors should rely on which approach to determine compliance?
• Default Accounts are defined as what?
• For eligible service providers, which SAQ should be used?
• How often must security controls be tested and validated?
• This SAQ should be used for Merchants with Only Imprint Machines or Only Standalone, Dial-out Terminals - No Electronic Cardholder Data Storage:
• To reduce PCI DSS scope, adequate network segmentation should do what?
• Which statement describes a common error that affects scoping accuracy?
• When properly reporting on each PCI DSS requirement you should:
• What is a key principle of encryption key management for CHD protection?
• TLS, IPSEC, SSH, HTTPS are considered:
• Who is qualified to perform official PCI DSS assessments?
• Select the correct order for a compliance validation assessment:
• What is the purpose of pre-engagement due diligence before engaging a service provider?
• Which organizations must comply with PCI DSS?
• Which credentialed roles are authorized to perform official PCI DSS assessments?
• Regarding magnetic stripe tracks, which statement is true?
• What is the primary purpose of an information security policy in PCI DSS?
• The purpose for the payment brands compliance programs are for:
• PAN masking requirements for display and documentation: which option is correct?
• What action should be taken when CHD is no longer needed?
• In PCI DSS scoping, which entity is most directly responsible for determining merchant levels?
• When must critical new security patches be installed?
• Which scenario is described as a poor scoping decision for PCI DSS?
• Which statement about physical security controls is true?
• Which statement best reflects the core access control principle for CHD in PCI DSS?
• Which data element is considered SAD and must not be stored post-authorization?
• What is data flow mapping and why is it essential for PCI scope determination?
• Which statement best describes a Hosting Provider?
• Differentiate SAQ A and SAQ D in terms of CHD handling.
• What does Track Data refer to in card data terminology?
• Authorization of a transaction usually takes place which of the following timeframes?
• Requirement 8.3.1 requiring multi-factor authentication for all non-console access into the CDE for personnel with administrative access is no longer required in version 3.2.1:
• A scoping decision is considered poor if which condition applies?
• Are there circumstances under which sensitive authentication data can be stored after authorization?