[Oct-2023] Assessor_New_V4 Dumps Full Questions – PCI Qualified Professionals Exam Study Guide [Q12-Q32]

Rate this post

[Oct-2023] Assessor_New_V4 Dumps Full Questions – PCI Qualified Professionals Exam Study Guide

Exam Questions and Answers for Assessor_New_V4 Study Guide

NEW QUESTION 12
In accordance with PCI DSS Requirement 10. how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available

At least 2 years, with the most recent 3 months immediately available

At least 2 years with the most recent month immediately available

At least 3 months with the most recent month immediately available

NEW QUESTION 13
Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or intrusion protection systems (IDS’IPS)?

Intrusion detection techniques are required on all system components

Intrusion detection techniques are required to alert personnel of suspected compromises

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data

NEW QUESTION 14
Which of the following is a requirement for multi-tenant service providers?

Ensure that customers cannot access another entity s cardholder data environment

Provide customers with access to the hosting provider s system configuration files.

Provide customers with a shared user ID for access to critical system binaries

Ensure that a customer’s log files are available to all hosted entities

NEW QUESTION 15
An internal NTP server that provides lime services to the Cardholder Data Environment is?

Only in scope if it provides time services to database servers.

Not in scope for PCI DSS

Only m scope if it stores processes or transmits cardholder data

In scope for PCI DSS

NEW QUESTION 16
Which of the following statements is true regarding track equivalent data on the chip of a payment card?

It is allowed to be stored by merchants after authorization if encrypted

It is sensitive authentication data

It is out of scope for PCI DSS

It is not applicable for PCI DSS Requirement 3.2

NEW QUESTION 17
Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

Each internal system is configured to be its own time server.

Access to time configuration settings is available to all users of the system.

Central time servers receive time signals from specific, approved external sources

Each internal system peersdirectorywith an external source to ensure accuracy of time updates

NEW QUESTION 18
According to the glossary, bespoke and custom software describes which type of software?

Any software developed by a third party

Any software developed by a third party that can be customized by an entity.

Software developed by an entity for the entity’s own use

Virtual payment terminals

NEW QUESTION 19
Which of the following is required to be included in an incident response plan?

Procedures for notifying PCI SSC of the security incident

Procedures for responding to the detection of unauthorized wireless access points

Procedures for securely deleting incident response records immediately upon resolution of the incident

Procedures forlaunching a reverse-attack on the individual(s) responsible for the security incident

NEW QUESTION 20
Assigning a unique ID to each person is intended to ensure?

Strong passwords are used for each user account

Shared accounts are only used by administrators

Individual users are accountable for their own actions

Access is assigned to group accounts based on need-to-know

NEW QUESTION 21
Which of the following describes the intent of installing one primary function per server?

To allow functions with different security levels to be implemented on the same server

To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server

To allow higher-security functions to protect lower-security functions installed on the same server

To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

NEW QUESTION 22
What process is requited by PCI DSS (or protecting card-reading devices at the point-of-sale?

Devices are periodically inspected to detect unauthorized card stammers.

The serial number of each device is periodically verified with the device manufacturer

Device identifiers and security labels are periodically replaced

Devices are physically destroyed if there is suspicion of compromise

NEW QUESTION 23
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)

DES256

RSA512

AES 128

ROT 13

NEW QUESTION 24
Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

NEW QUESTION 25
If disk encryption is used to protect account data what requirement should be met for the disk encryption solution?

Access to the disk encryption must be managed independently of the operating system access control mechanisms

The disk encryption system must use the same user account authenticator as the operating system

The decryption keys must be associated with the local user account database

The decryption keys must be stored within the local user account database

NEW QUESTION 26
Which of the following is true regarding internal vulnerability scans?

They must be performed after a significant change

They must be performed by an Approved Scanning Vendor (ASV)

They must be performed by QSA personnel

They must be performed at least annually

NEW QUESTION 27
PCI DSS Requirement 12.7 requires screening and background checks for which of the following?

All personnel employed by the organization

Personnel with access to the cardholder data environment.

Visitors with access to the organization s facilities

Cashiers with access to one card number at a time

NEW QUESTION 28
An entity wants to know if the Software Security Framework can be leveraged during their assessment Which of the following software types would this apply to?

Any payment software in the CDE

Only software which runs on PCI PTS devices

Validated Payment Applications that are listed by PCI SSC and have undergone a PA-DSS assessment

Software developed by the entity in accordance with the Secure SLC Standard

NEW QUESTION 29
If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?

Verify the segmentation controls allow only necessary traffic into the cardholder data environment.

Verify the payment card brands have approved the segmentation

Verify that approved devices and applications are used for the segmentation controls

Verify the controls used for segmentation are configured properly and functioning as intended

NEW QUESTION 30
According torequirement 1,what is the purpose of “Network Security Controls?

Manage anti-malware throughout the CDE.

Control network traffic between two or more logical or physical network segments.

Discover vulnerabilities and rank them

Encrypt PAN when stored

NEW QUESTION 31
An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

NEW QUESTION 32
Which of the following describes “stateful responses’ to communication initiated by a trusted network?

Administrative access to respond to requests to change the firewall is limited to one individual at a time

Active network connections are tracked so that invalid response’ traffic can be identified.

A current baseline of application configurations is maintained and any mis-configuration is responded to promptly

Logs of user activity on the firewall are correlated to identify and respond to suspicious behavior