Valid QSA_New_V4 Exam Q&A PDF QSA_New_V4 Dump is Ready (Updated 71 Questions) [Q23-Q47]

Rate this post

Valid QSA_New_V4 Exam Q&A PDF QSA_New_V4 Dump is Ready (Updated 71 Questions)

Exam Questions and Answers for QSA_New_V4 Study Guide

PCI SSC QSA_New_V4 Exam Syllabus Topics:

Section	Weight	Objectives
PCI DSS v4.0 Core Requirements & Intent	35%	– 12 PCI DSS Requirements and sub-requirements 1. Control objectives and intent 2. Customized and targeted risk assessment approaches 3. New/updated controls in v4.0
Validation & Program Rules	10%	– Merchant/Service Provider levels 1. QSA company and individual obligations 2. Renewal and maintenance requirements
Reporting & Documentation	15%	– ROC, SAQ, Attestation of Compliance 1. Remediation planning and timelines 2. Finding categorization and severity rating
Payment Brand Specific Requirements	15%	– Visa, Mastercard, Amex, Discover, JCB rules 1. Brand-specific validation and reporting mandates
Assessment Methodology & Testing Procedures	25%	– Testing techniques and criteria 1. Gap analysis and validation – Assessment scope definition 1. Sampling methodologies 2. Evidence collection and verification

NO.23 Which statement is true regarding the PCI DSS Report on Compliance (ROC)?

The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.

The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC.

The assessor must create their own ROC template tor each assessment report.

The ROC Reporting Template provided by PCI SSC is only required for service provider assessments.

NO.24 Which statement is true regarding the presence of both hashed and truncated versions of the same PAN in an environment?

Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions.

The hashed version of the PAN must also be truncated per PCI DSS requirements for strong cryptography.

The hashed and truncated versions must be correlated so the source PAN can be identified.

Hashed and truncated versions of a PAN must not exist in same environment.

NO.25 Which of the following is an example of multi-factor authentication?

A token that must be presented twice during the login process.

A user passphrase and an application-level password.

A user password and a PIN-activated smart card.

A user fingerprint and a user thumbprint.

NO.26 Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or Intrusion protection systems (IDS/IPS)?

Intrusion detection techniques are required on all system components.

Intrusion detection techniques are required to alert personnel of suspected compromises.

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data.

NO.27 In accordance with PCI DSS Requirement 10, how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available.

At least 2 years, with the most recent 3 months immediately available.

At least 2 years, with the most recent month immediately available.

At least 3 months, with the most recent month immediately available.

NO.28 Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?

Routers that monitor network traffic flows between the CDE and out-of-scope networks.

Firewalls that log all network traffic flows between the CDE and out-of-scope networks.

Virtual LANs that route network traffic between the CDE and out-of-scope networks.

A network configuration that prevents all network traffic between the CDE and out-of-scope networks.

NO.29 What does the PCI PTS standard cover?

Point-of-interaction devices used to protect account data.

Secure coding practices for commercial payment applications.

Development of strong cryptographic algorithms.

End-to-end encryption solutions for transmission of account data.

NO.30 If disk encryption is used to protect account data, what requirement should be met for the disk encryption solution?

Access to the disk encryption must be managed independently of the operating system access control mechanisms.

The disk encryption system must use the same user account authenticator as the operating system.

The decryption keys must be associated with the local user account database.

The decryption keys must be stored within the local user account database.

NO.31 An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

NO.32 Which of the following types of events is required to be logged?

All use of end-user messaging technologies.

All access to external web sites.

All access to all audit trails.

All network transmissions.

NO.33 Which statement about PAN is true?

It must be protected with strong cryptography for transmission over private wireless networks.

It must be protected with strong cryptography tor transmission over private wired networks.

It does not require protection for transmission over public wireless networks.

It does not require protection for transmission over public wired networks.

NO.34 A sample of business facilities is reviewed during the PCI DSS assessment. What is the assessor required to validate about the sample?

It includes a consistent set of facilities that are reviewed for all assessments.

The number of facilities in the sample is at least 10 percent of the total number of facilities.

Every facility where cardholder data is stored is reviewed.

All types and locations of facilities are represented.

NO.35 Which of the following statements Is true whenever a cryptographic key Is retired and replaced with a new key?

Anew key custodian must be assigned.

All data encrypted under the retired key must be securely destroyed.

Cryptographic key components from the retired key must be retained for 3 months before disposal.

The retired key must not be used for encryption operations.

NO.36 Where can live PANs be used for testing?

Production (live) environments only.

Pre-production (test) environments only if located outside the CDE.

Pre-production environments that are located within the CDE.

Testing with live PANs must only be performed in the QSA Company environment.

NO.37 Which of the following file types must be monitored by a change-detection mechanism (e.g., a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

NO.38 An internal NTP server that provides time services to the Cardholder Data Environment is?

Only in scope if it provides time services to database servers.

Not in scope for PCI DSS.

Only in scope if it stores, processes or transmits cardholder data.

In scope for PCI DSS.

NO.39 Which scenario meets PCI DSS requirements for restricting access to databases containing cardholder data?

User access to the database Is only through programmatic methods.

User access to the database Is restricted to system and network administrators.

Application IDs for database applications can only be used by database administrators.

Direct queries to the database are restricted to shared database administrator accounts.

NO.40 Security policies and operational procedures should be?

Encrypted with strong cryptography.

Stored securely so that only management has access.

Reviewed and updated at least quarterly.

Distributed to and understood by all affected parties.

NO.41 Which statement about PAN is true?

It must be protected with strong cryptography tor transmission over private wired networks.

It must be protected with strong cryptography for transmission over private wireless networks.

It does not require protection for transmission over public wired networks.

It does not require protection for transmission over public wireless networks.

NO.42 Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?

Routers that monitor network traffic flows between the CDE and out-of-scope networks.

Firewalls that log all network traffic flows between the CDE and out-of-scope networks.

Virtual LANs that route network traffic between the CDE and out-of-scope networks.

A network configuration that prevents all network traffic between the CDE and out-of-scope networks.

NO.43 What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128-bit data- encrypting key (DEK)?

DES 256

RSA 512

AES 128

ROT 13

NO.44 A sample of business facilities is reviewed during the PCI DSS assessment. What is the assessor required to validate about the sample?

It includes a consistent set of facilities that are reviewed for all assessments.

The number of facilities in the sample is at least 10 percent of the total number of facilities.

Every facility where cardholder data is stored is reviewed.

All types and locations of facilities are represented.

NO.45 Assigning a unique ID to each person is intended to ensure?

Strong passwords are used for each user account.

Shared accounts are only used by administrators.

Individual users are accountable for their own actions.

Access is assigned to group accounts based on need-to-know.

NO.46 An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are assigned only to administrative groups, and not to regular users.

A different certificate is assigned to each individual user account, and certificates are not shared.

Certificates are logged so they can be retrieved when the employee leaves the company.

Change control processes are in place to ensure certificates are changed every 90 days.

NO.47 Which of the following statements Is true whenever a cryptographic key Is retired and replaced with a new key?

The retired key must not be used for encryption operations.

Cryptographic key components from the retired key must be retained for 3 months before disposal.

Anew key custodian must be assigned.

All data encrypted under the retired key must be securely destroyed.

Certification dumps – PCI Qualified Professionals QSA_New_V4 guides – 100% valid: https://www.trainingquiz.com/QSA_New_V4-practice-quiz.html

Quiz Training Materials

Valid QSA_New_V4 Exam Q&A PDF QSA_New_V4 Dump is Ready (Updated 71 Questions) [Q23-Q47]

PCI SSC QSA_New_V4 Exam Syllabus Topics:

Leave a Reply Cancel reply