Question 1

Which if the following is true, regarding the entity sharing cardholder data with a service provider?

Options :

A : The service provider may only store, process or transmit cardholder data that is encrypted; and is therefore out of scope of PCI DSS

B : The service provider must produce the quarterly ASV scan results, and a penetration test report, before the entity engages with the service provider

C : The entity must have an established process of engaging service provider, including proper due diligence prior to engagement

D : The service provider must be PCI-DSS compliant before the entity engages with the service provider

Answer: C

Question 2

Storing track data "long term" or "persistently" is permitted when_______.

Options :

A : It is being stored by the issuers

B : It is hashed by the merchants storing it.

C : It is encrypted by the merchant storing it.

D : It is reported to the PCI SSC annually in a ROC

Answer: A

Question 3

What activity occurs during the “settlement” step of the payment process?

Options :

A : The merchant receives payment for the transaction

B : The merchant and the issuer exchange purchase information

C : The acquirer bills the cardholder for the transaction

D : The merchant exchanges purchase information with the acquirer and the issuer

Answer: D

Question 4

A service provider with no electronic cardholder data storage may be eligible to complete with SAQ?

Options :

A : SAQ C

B : SAQ D

C : SAQ A

D : SAQ B

Answer: B

Question 5

Merchants with payment application system connected to the internet and with no electric cardholder data storage may be eligible to complete which SAQ?

Options :

A : SAQ B

B : SAQ A

C : SAQ C

D : SAQ C-VT

Answer: C

Free QSA_New Mock Exam – Practice Online Confidently

Buying Options: