PCIP 2023/2024 Study Guide with Complete Solutions Requirement 1 - Correct Answer Install and maintain a firewall configuration to protect cardholder data Requirement 2 - Correct Answer Do not use vendor supplied defaults for system passwords and other security parameters Requirement 3 - Correct Answer Protect stored cardholder data by enacting a formal data retention policy and implement secure deletion methods Requirement 4 - Correct Answer Encrypt transmission of cardholder data across open, public networks Requirement 5 - Correct Answer Protect all systems against malware and regularly update anti-virus software or programs Requirement 6 - Correct Answer Develop and maintain secure systems and applications Requirement 7 - Correct Answer Restrict access to cardholder data by business need to know Requirement 8 - Correct Answer Identify and authenticate access to system components Requirement 9 - Correct Answer Restrict physical access to cardholder data Requirement 10 - Correct Answer Track and monitor all access to network resources and cardholder data Requirement 11 - Correct Answer Regularly test security systems and processes Requirement 12 - Correct Answer Maintain a policy that addresses information security for all personnel Appendix A1 - Correct Answer Shared hosting providers must protect the cardholder data environment Appendix A2 - Correct Answer Additional PCI DSS Requirements for Entities using SSL/early TLS Appendix A3 - Correct Answer Designated Entities Supplemental Validation (DESV) 1 / 2
Compensating Controls - Correct Answer 1- Meet the intent and rigor of the original PCI requirement 2- Sufficiently offset the risk that the original PCI DSS requirement was designed to defend against 3- Be "above and beyond" other PCI DSS requirements (i.e., not simply in compliance with other requirements) 4- Be commensurate with additional risk imposed by not adhering to original requirement Compensating Controls - - Correct Answer To consider Compensating Controls, one of
the following must exist that precludes implementing the stated control:
1- Legitimate Technical Constraint 2- Documented Business Constraint Compensating Controls : - Correct Answer Existing PCI DSS requirements CANNOT be considered as compensating controls if they are already required for the Compensating Controls ... - Correct Answer Existing PCI DSS requirements may be combined with new controls to become a compensating control SAQs - Correct Answer is a validation tool intended to assist merchants and service providers in self-evaluating their compliance with the PCI DSS SAQ A - Correct Answer Card-Not-Present (e-commerce or MO/TO) merchants, all cardholder data functions outsourced to PCI DSS compliant service providers.Not applicable to face-to-face channels.SAQ A-EP - Correct Answer E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn't directly receive cardholder data but that can impact the security of the payment transaction. No electronic storage, processing, or transmission of any cardholder data on the merchant's systems or premises.Applicable only to e-commerce channels.SAQ B - Correct Answer Imprint-only merchants with no electronic cardholder data storage, or standalone, dial-out terminal merchants with no electronic cardholder data storage.Not applicable to e-commerce channels.SAQ B-IP - Correct Answer Merchants using only stand-alone, PTS-approved payment terminals with an IP connection to the payment processor, with no electronic cardholder data storage.Not applicable to e-commerce channels.
- / 2