Question 1

Level 1 and 2 merchants must include_______ as the part of their PCI-DSS compliance validation reporting process?

Options :

A : Sensitive authentication data (SAD)

B : A copy of their risk assessment

C : A report from their QSA

D : ASV scan results

Answer: D

Question 2

When should penetration testing be performed?

Options :

A : At least quarterly, and after any change to user access or file access permission

B : At least annually, and after any change to user access permission

C : At least quarterly, and after any significant changes to the network

D : At least annually, and after any significant changes to infrastructure or applications

Answer: D

Question 3

Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?

Options :

A : Routers that monitor network traffic flows between the CDE and out-of-scope networks

B : Firewalls that log all network traffic flows between the CDE and out-of-scope networks

C : Virtual LANs that route network traffic between the CDE and out-of-scope networks

D : A network configuration that prevents all network traffic between the CDE and out-of-scope network

Answer: D

Question 4

What is true regarding the use of compensating controls?

Options :

A : Compensating controls do not need to be documented

B : Controls must be in place to ensure compensating controls remain effective after they've been assessed

C : Compensating controls increase the risk to the organizations

D : Compensating controls cannot be changed once they've been implemented

Answer: B

Question 5

After the 31 of the March 2025, how frequent must you review the system and application account privileges?

Options :

A : At every quarter.

B : There are no requirements for system accounts, so they should never.

C : Biannually

D : Periodically. The frequency is defined in the TRA (targeted risk analysis) of the entity-s .

Answer: D

Free QSA_New Mock Exam – Practice Online Confidently