Check the Free demo of our QSA_New_V4 Exam Dumps with 42 Questions [Q15-Q34]

4/5 - (1 vote)

Check the Free demo of our QSA_New_V4 Exam Dumps with 42 Questions

Clear your concepts with QSA_New_V4 Questions Before Attempting Real exam

NO.15 A retail merchant has a server room containing systems that store encrypted PAN data. The merchant has Implemented a badge access-control system that Identifies who entered and exited the room, on what date, and at what time. There are no video cameras located in the server room.Based on this information, which statement is true regarding PCI DSS physical security requirements?

The badge access-control system must be protected from tampering or disabling.

The merchant must Install video cameras in addition to the existing access-control system.

Data from the access-control system must be securely deleted on a monthly basis.

The merchant must install motion-sensing alarms In addition to the existing access-control system.

NO.16 An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA. During the assessment, you spend time completing the Controls Matrix and the TRA, while also ensuring that the customized control is implemented securely. Which of the following statements is true?

You can assess the customized control, but another assessor must verify thatyou completed the TRA correctly.

You can assess the customized control and verify that the customized approach was correctly followed, but you must document this in the ROC.

You must document the work on the customized control in the ROC, but you can not assess the control or the documentation.

Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA.

NO.17 An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

NO.18 In accordance with PCI DSS Requirement 10, how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available.

At least 2 years, with the most recent 3 months immediately available.

At least 2 years, with the most recent month immediately available.

At least 3 months, with the most recent month immediately available.

NO.19 Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or Intrusion protection systems (IDS/IPS)?

Intrusion detection techniques are required on all system components.

Intrusion detection techniques are required to alert personnel of suspected compromises.

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data.

NO.20 What isthe intent of classifying media that contains cardholder data?

Ensuring that media is properly protected according to the sensitivity of the data it contains.

Ensuring that media containing cardholder data Is moved from secured areas an a quarterly basis.

Ensuring that media is clearly and visibly labeled as “Confidential” so all personnel know that the media contains cardholder data.

Ensuring that all media is consistently destroyed on the same schedule, regardless of the contents.

NO.21 Which of the following file types must be monitored by a change-detection mechanism (for example, a file- integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

NO.22 At which step in the payment transaction process does the merchant’s bank pay the merchant for the purchase, and the cardholder’s bank bill the cardholder?

Authorization

Clearing

Settlement

Chargeback

NO.23 Which of the following statements Is true whenever a cryptographic key Is retired and replaced with a new key?

The retired key must not be used for encryption operations.

Cryptographic key components from the retired key must be retained for 3 months before disposal.

Anew key custodian must be assigned.

All data encrypted under the retired key must be securely destroyed.

NO.24 What should the assessor verify when testing that cardholder data Is protected whenever It Is sent over open public networks?

The security protocol Is configured to accept all digital certificates.

A proprietary security protocol is used.

The security protocol accepts only trusted keys.

The security protocol accepts connections from systems with lower encryption strength than required by the protocol.

NO.25 Which statement is true regarding the PCI DSS Report on Compliance (ROC)?

The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC.

The ROC Reporting Template provided by PCI SSC is only required for service provider assessments.

The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.

The assessor must create their own ROC template tor each assessment report.

NO.26 Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

Each Internal system Is configured to be Its own time server.

Access to time configuration settings is available to all users of the system.

Central time servers receive time signals from specific, approved external sources.

Each internal system peers directly with an external source to ensure accuracy of time updates.

NO.27 A sample of business facilities is reviewed during the PCI DSS assessment. What is the assessor required to validate about the sample?

It includes a consistent set of facilities that are reviewed for all assessments.

The number of facilities in the sample is at least 10 percent of the total number of facilities.

Every facility where cardholder data is stored is reviewed.

All types and locations of facilities are represented.

NO.28 An LDAP server providing authentication services to the cardholder data environment is_____________?

in scope for PCI DSS.

not In scope for PCI DSS.

in scope only if it stores, processes or transmits cardholder data.

in scope only if itprovides authentication services to systems in the DMZ.

NO.29 Which systems must have anti-malware solutions?

All CDE systems, connected systems.NSCs, and security-providing systems.

All portable electronic storage.

All systems that store PAN.

Any in-scope system except for those identified as ‘not at risk’ from malware.

NO.30 Which of the following is true regarding compensating controls?

A compensating control is not necessary if all other PCI DSS requirements are in place.

A compensating control must address the risk associated with not adhering to the PCI DSS requirement.

An existing PCI DSS requirement can be used as compensating control if it is already implemented.

A compensating control worksheet is not required if the acquirer approves the compensating control.

NO.31 An organization wishes to implement multi-factor authentication for remote access, using the user’s Individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are assigned only to administrative groups, and not to regular users.

A different certificate is assigned to each individual user account, and certificates are not shared.

Certificates are logged so they can be retrieved when the employee leaves the company.

Change control processes are In place to ensure certificates are changed every 90 days.