Which of the following is required to be included in an incident response plan?

• A.Procedures for notifying PCI SSC of the security incident.
• B.Procedures for responding to the detection of unauthorized wireless access points.
• C.Procedures for securely deleting incident response records immediately upon resolution of the incident.
• D.Procedures for launching a reverse-attack on the individual(s) responsible for the security incident.

Comment: *

Name: *

Email: *

Verification: *

Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or Intrusion protection systems (IDS/IPS)?

• A.Intrusion detection techniques are required on all system components.
• B.Intrusion detection techniques are required to alert personnel of suspected compromises.
• C.Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems
• D.Intrusion detection techniques are required to identify all instances of cardholder data.

Comment: *

Name: *

Email: *

Verification: *

Could an entity use both the Customized Approach and the Defined Approach to meet the same requirement?

• A.No, because a single approach must be selected.
• B.No, because only compensating controls can be used with the Defined Approach.
• C.Yes, if the entity uses no compensating controls.
• D.Yes, if the entity is eligible to use both approaches.

Comment: *

Name: *

Email: *

Verification: *

Which statement is true regarding the PCI DSS Report on Compliance (ROC)?

• A.The ROC Reporting Template provided by PCI SSC is only required for service provider assessments.
• B.The assessor must create their own ROC template tor each assessment report.
• C.The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC.
• D.The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true regarding track equivalent data on the chip of a payment card?

• A.It is allowed to be stored by merchants after authorization, if encrypted.
• B.It is sensitive authentication data.
• C.It is out of scope for PCI DSS.
• D.It is not applicable for PCI DSS Requirement 3.2.

Comment: *

Name: *

Email: *

Verification: *