In the ROC Reporting Template, which of the following is the best approach for a response where the requirement was "In Place"?

• A.Details of the entity's project plan for implementing the requirement.
• B.Details of how the assessor observed the entity's systems were compliant with the requirement.
• C.Details of the entity's reason for not implementing the requirement.
• D.Details of how the assessor observed the entity's systems were not compliant with the requirement.

Comment: *

Name: *

Email: *

Verification: *

Which of the following can be sampled for testing during a PCI DSS assessment?

• A.PCI DSS requirements and testing procedures.
• B.Compensating controls.
• C.Business facilities and system components.
• D.Security policies and procedures.

Comment: *

Name: *

Email: *

Verification: *

In accordance with PCI DSS Requirement 10, how long must audit logs be retained?

• A.At least 1 year, with the most recent 3 months immediately available.
• B.At least 2 years, with the most recent 3 months immediately available.
• C.At least 2 years, with the most recent month immediately available.
• D.At least 3 months, with the most recent month immediately available.

Comment: *

Name: *

Email: *

Verification: *

What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128-bit data- encrypting key (DEK)?

• A.DES 256
• B.RSA 512
• C.AES 128
• D.ROT 13

Comment: *

Name: *

Email: *

Verification: *

A retail merchant has a server room containing systems that store encrypted PAN data. The merchant has implemented a badge access-control system that identifies who entered and exited the room, on what date, and at what time. There are no video cameras located in the server room. Based on this information, which statement is true regarding PCI DSS physical security requirements?

• A.The badge access-control system must be protected from tampering or disabling.
• B.The merchant must install video cameras in addition to the existing access-control system.
• C.Data from the access-control system must be securely deleted on a monthly basis.
• D.The merchant must install motion-sensing alarms in addition to the existing access-control system.

Comment: *

Name: *

Email: *

Verification: *