(Oct-2023) Assessor_New_V4 Exam Dumps Contains FREE Real Quesions from the Actual Exam [Q19-Q42]

Q19. Which of the following is true regarding compensating controls?

A compensating control is not necessary if all other PCI DSS requirements are in place

A compensating control must address the risk associated with not adhering to the PCI DSS requirement

An existing PCI DSS requirement can be used as compensating control if it is already implemented

A compensating control worksheet is not required if the acquirer approves the compensating control

Q20. At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?

Authorization

Clearing

Settlement

Chargeback

Q21. Which of the following describes “stateful responses’ to communication initiated by a trusted network?

Administrative access to respond to requests to change the firewall is limited to one individual at a time

Active network connections are tracked so that invalid response’ traffic can be identified.

A current baseline of application configurations is maintained and any mis-configuration is responded to promptly

Logs of user activity on the firewall are correlated to identify and respond to suspicious behavior

Q22. According to the glossary, bespoke and custom software describes which type of software?

Any software developed by a third party

Any software developed by a third party that can be customized by an entity.

Software developed by an entity for the entity’s own use

Virtual payment terminals

Q23. Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

Q24. What must be included m an organization’s procedures for managing visitors9

Visitors are escorted at all times within areas where cardholder data is processed or maintained

Visitor badges are identical to badges used by onsite personnel

Visitor log includes visitor name, address, and contact phone number

Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit

Q25. Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or intrusion protection systems (IDS’IPS)?

Intrusion detection techniques are required on all system components

Intrusion detection techniques are required to alert personnel of suspected compromises

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data

Q26. Could an entity use both the Customized Approach and the Defined Approach to meet the same requirement?

No because a single approach must be selected

No. because only compensating controls can be used with the Defined Approach

Yes if the entity uses no compensating controls

Yes if the entity is eligible to use both approaches

Q27. If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?

Verify the segmentation controls allow only necessary traffic into the cardholder data environment.

Verify the payment card brands have approved the segmentation

Verify that approved devices and applications are used for the segmentation controls

Verify the controls used for segmentation are configured properly and functioning as intended

Q28. Which of the following is true regarding internal vulnerability scans?

They must be performed after a significant change

They must be performed by an Approved Scanning Vendor (ASV)

They must be performed by QSA personnel

They must be performed at least annually

Q29. Which of the following can be sampled for testing during a PCI DSS assessment?

PCI DSS requirements and testing procedures.

Compensating controls

Business facilities and system components

Security policies and procedures

Q30. Which of the following is a requirement for multi-tenant service providers?

Ensure that customers cannot access another entity s cardholder data environment

Provide customers with access to the hosting provider s system configuration files.

Provide customers with a shared user ID for access to critical system binaries

Ensure that a customer’s log files are available to all hosted entities

Q31. In accordance with PCI DSS Requirement 10. how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available

At least 2 years, with the most recent 3 months immediately available

At least 2 years with the most recent month immediately available

At least 3 months with the most recent month immediately available

Q32. Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

Each internal system is configured to be its own time server.

Access to time configuration settings is available to all users of the system.

Central time servers receive time signals from specific, approved external sources

Each internal system peersdirectorywith an external source to ensure accuracy of time updates

Q33. An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA During the assessment, you spend time completing the Controls Matrix and the TRA. while also ensuing that the customized control is implemented securely Which of the following statements is true?

You can assess the customized control but another assessor must verify that you completed the TRA correctly

You can assess the customized control and verify that the customized approach was correctly followed but you must document this in the ROC

You must document the work on the customized control in the ROC but you can not assess the control or the documentation

Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA

Q34. Which of the following types of events is required to be logged?

All use of end-user messaging technologies

All access to external web sites

All access to all audit trails

All network transmissions

Q35. Which of the following is an example of multi-factor authentication?

A token that must be presented twice during the login process

A user passphrase and an application level password.

A user password and a PIN-activated smart card

A user fingerprint and a user thumbprint

Q36. Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?

The retired key must not be used for encryption operations

Cryptographic key components from the retired key must be retained for 3 months before disposal

A new key custodian must be assigned

All data encrypted under the retired key must be securely destroyed

Q37. An internal NTP server that provides lime services to the Cardholder Data Environment is?

Only in scope if it provides time services to database servers.

Not in scope for PCI DSS

Only m scope if it stores processes or transmits cardholder data

In scope for PCI DSS

Q38. Which systems must have anti-malware solutions’

All CDE systems, connected systems. NSCs. and security-providing systems

All portable electronic storage

All systems that store PAN

Any in-scope system except for those identified as not at risk from malware

Q39. According torequirement 1,what is the purpose of “Network Security Controls?

Manage anti-malware throughout the CDE.

Control network traffic between two or more logical or physical network segments.

Discover vulnerabilities and rank them

Encrypt PAN when stored

Q40. What does the PCI PTS standard cover?

Point-of-interaction devices used to protect account data

Secure coding practices for commercial payment applications.

Development of strong cryptographic algorithms

End-to-end encryption solutions for transmission of account data

Q41. An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are logged so they can be retrieved when the employee leaves the company

Change control processes are in place to ensue certificates are changed every 90 days

Certificates are assigned only to administrative groups and not to regular users

A different certificate is assigned to each individual user account, and certificates are not shared

Q42. Which scenario meets PCI DSS requirements for restricting access to databases containing cardholder data?

User access to the database is only through programmatic methods

User access to the database is restricted to system and network administrators

Application IDs for database applications can only be used by database administrators

Direct queries to the database are restricted to shared database administrator accounts

Leave a Reply Cancel reply