An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

• A.Certificates are assigned only to administrative groups, and not to regular users.
• B.A different certificate is assigned to each individual user account, and certificates are not shared.
• C.Certificates are logged so they can be retrieved when the employee leaves the company.
• D.Change control processes are in place to ensure certificates are changed every 90 days.

Comment: *

Name: *

Email: *

Verification: *

Which of the following meets the definition of "quarterly" as Indicated In the description of timeframes used In PCI DSS requirements?

• A.Occurring at some point in each quarter of a year.
• B.At least once every 95-97 days
• C.On the 15th of each third month.
• D.On the 1st of each fourth month.

Comment: *

Name: *

Email: *

Verification: *

A "Partial Assessment" is a new assessment result. What is a "Partial Assessment"?

• A.A ROC that has been completed after using an SAQ to determine which requirements should be tested, as per FAQ 1331.
• B.An interim result before the final ROC has been completed.
• C.A term used by payment brands and acquirers to describe entities that have multiple payment channels, with each channel having its own assessment.
• D.An assessment with at least one requirement marked as "Not Tested".

Comment: *

Name: *

Email: *

Verification: *

An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA. During the assessment, you spend time completing the Controls Matrix and the TRA, while also ensuring that the customized control is implemented securely. Which of the following statements is true?

• A.You can assess the customized control, but another assessor must verify thatyou completed the TRA correctly.
• B.You can assess the customized control and verify that the customized approach was correctly followed, but you must document this in the ROC.
• C.You must document the work on the customized control in the ROC, but you can not assess the control or the documentation.
• D.Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA.

Comment: *

Name: *

Email: *

Verification: *

What process is required by PCI DSS for protecting card-reading devices at the point-of-sale?

• A.Device identifiers and security labels are periodically replaced.
• B.The serial number of each device is periodically verified with the device manufacturer.
• C.Devices are physically destroyed if there is suspicion of compromise.
• D.Devices are periodically inspected to detect unauthorized card skimmers.

Comment: *

Name: *

Email: *

Verification: *