Question 1

A CPSA Company has submitted multiple reports that are incomplete and do not contain the information described in the reporting instructions. Which of the following are possible outcomes?

Options :

A : They may be put into remediation or revoked by the applicable payment brands

B : They may be put into remediation or revoked by PCI SSC

C : They may be fined by the applicable payment brands

D : They may be fined by PCI SSC

Answer: A

Question 2

For how long must a CPSA Company maintain workpapers and technical information obtained during an assessment?

Options :

A : Until each applicable payment brand has accepted (and signed off) the ROC and AOC

B : As long as the entity under assessment is a client of the CPSA Company

C : 3 years

D : 1 year

Answer: C

Question 3

Which of the following personnel changes must result in the vendor notifying the Vendor Program Administration (VPA)?

Options :

A : Adding additional rights to someone’s role to give them access to the mam production vault

B : Any change to a role that directly affects the security of card products and related components

C : Hiring someone that will directly interact with the card issuers

D : Promoting someone to senior management levell

Answer: B

Question 4

CCTV cameras should not have zoom or scanning functionality in which of the following locations?

Options :

A : PIN-mailer room

B : Cloud-based provisioning areas

C : Work In Progress room (WIP)

D : Vault

E : Destruction room

F : Security Control Room (SCR)

Answer: A

Question 5

During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Options :

A : Employee information, including background checks, must be stored for at least seven years

B : Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

C : The vendor must retain the background information for at least 18 months after termination of contract

D : The vendor must only retain background information for all current employees, not for those that have been terminated

Answer: A

Free CPSA_P_New Mock Exam – Practice Online Confidently

Buying Options: