Assessor_New_V4 Dumps with Practice Exam Questions Answers
Assessor_New_V4 by PCI Qualified Professionals Actual Free Exam Practice Test
NEW QUESTION # 28
What must be included m an organization's procedures for managing visitors9
- A. Visitors are escorted at all times within areas where cardholder data is processed or maintained
- B. Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit
- C. Visitor log includes visitor name, address, and contact phone number
- D. Visitor badges are identical to badges used by onsite personnel
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, visitors are escorted at all times within areas where cardholder data is processed or maintained, visitor badges are identical to badges used by onsite personnel, visitor log includes visitor name, address, and contact phone number, visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit. These are some examples of procedures that must be included in an organization's procedures for managing visitors who access in-scope systems where cardholder data is processed or maintained.
NEW QUESTION # 29
Assigning a unique ID to each person is intended to ensure?
- A. Shared accounts are only used by administrators
- B. Access is assigned to group accounts based on need-to-know
- C. Individual users are accountable for their own actions
- D. Strong passwords are used for each user account
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, individual users are accountable for their own actions, which means they should use strong passwords, change them regularly, and not share them with anyone else. This is one of the requirements for ensuring that user accounts are properly managed and controlled.
NEW QUESTION # 30
Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?
- A. Each internal system is configured to be its own time server.
- B. Central time servers receive time signals from specific, approved external sources
- C. Access to time configuration settings is available to all users of the system.
- D. Each internal system peersdirectorywith an external source to ensure accuracy of time updates
Answer: B
Explanation:
Explanation
critical systems must have correct and consistent time, which means they should use a reliable time source and synchronize their clocks with other systems. This is one of the requirements for ensuring that critical systems have accurate time.
NEW QUESTION # 31
Viewing of audit log files should be limited to?
- A. Individuals with administrator privileges
- B. Individuals with read/write access
- C. Individuals who performed the logged activity
- D. Individuals with a job-related need
Answer: D
Explanation:
Explanation
PCI DSS Requirement 10.5.5 states that entities must restrict access to audit logs to those with a job-related need1. This is to prevent unauthorized or malicious users from tampering with or deleting the audit logs, which could compromise the integrity andavailability of the logs and hinder the detection and investigation of security incidents. Audit logs contain sensitive and confidential information, such as cardholder data, user identities, system activities, and security events, and therefore must be protected from unauthorized viewing, modification, or deletion2. Individuals with a job-related need are those who have a legitimate and documented business reason to access the audit logs, such as system administrators, security personnel, auditors, or investigators3. Therefore, the correct answer is option D.
The other options are not true regarding the access control for audit log files. Option A is not true because individuals who performed the logged activity may not have a job-related need to view the audit logs, and may have a conflict of interest or malicious intent to alter or erase the logs. Option B is not true because individuals with read/write access may not have a job-related need to access the audit logs, and may pose a risk of unauthorized or accidental modification or deletion of the logs. Option C is not true because individuals with administrator privileges may not have a job-related need to access the audit logs, and may abuse their privileges or be targeted by attackers to compromise the logs. References:
PCI DSS v3.2.1
Effective Daily Log Monitoring - PCI Security Standards Council
Logging for PCI DSS Compliance - Tueoris
NEW QUESTION # 32
What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?
- A. The PAN is securely deleted once the transmission has been sent
- B. The security protocol is configured to accept all digital certificates
- C. The security protocol is configured to support earlier versions
- D. The PAN is encrypted with strong cryptography
Answer: D
Explanation:
Explanation
when PAN is sent over the Internet, PAN must be encrypted with strong cryptography, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 33
An internal NTP server that provides lime services to the Cardholder Data Environment is?
- A. Not in scope for PCI DSS
- B. Only m scope if it stores processes or transmits cardholder data
- C. In scope for PCI DSS
- D. Only in scope if it provides time services to database servers.
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an internal NTP server that provides time services to the cardholder data environment is in scope for PCI DSS if it stores processes or transmits cardholder data, regardless of whether it provides authentication services to systems in the DMZ or not. This is one of the requirements for preventing unauthorized access to cardholder data using time services.
NEW QUESTION # 34
Which systems must have anti-malware solutions'
- A. All systems that store PAN
- B. All CDE systems, connected systems. NSCs. and security-providing systems
- C. All portable electronic storage
- D. Any in-scope system except for those identified as not at risk from malware
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, any in-scope system except for those identified as not at risk from malware must have anti-malware solutions installed and configured according to best practices. This is one of the requirements for preventing malware infections that could compromise cardholder data.
NEW QUESTION # 35
An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?
- A. Certificates are assigned only to administrative groups and not to regular users
- B. Change control processes are in place to ensue certificates are changed every 90 days
- C. Certificates are logged so they can be retrieved when the employee leaves the company
- D. A different certificate is assigned to each individual user account, and certificates are not shared
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a different certificate is assigned to each individual user account, and certificates are not shared. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
NEW QUESTION # 36
Which of the following is true regarding internal vulnerability scans?
- A. They must be performed by an Approved Scanning Vendor (ASV)
- B. They must be performed at least annually
- C. They must be performed by QSA personnel
- D. They must be performed after a significant change
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, internal vulnerability scans must be performed after a significant change in any component or configuration that affects cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.
NEW QUESTION # 37
A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?
- A. Disable any firewall functions that are not needed in production
- B. Remove the default 'Firewall Administrator account and create a shared account for firewall administrators to use.
- C. Configure the firewall to permit all traffic until additional rules are defined
- D. Synchronize the firewall rules with the other firewalls m the environment
Answer: D
Explanation:
Explanation
According to requirement 3.1.2, a network firewall should be configured to permit only traffic that is necessary for its operation and security, which means it should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
NEW QUESTION # 38
Which statement about the Attestation of Compliance (AOC) is correct?
- A. There are different AOC templates for service providers and merchants
- B. The AOC must be signed by both the merchant/service provider and by PCI SSC
- C. The same AOC template is used for ROCs and SAQs
- D. The AOC must be signed by either the merchant service provider or the QSA'ISA
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the same AOC template is used for ROCs and SAQs. This is one of the requirements for ensuring consistency and accuracy in ROCs and SAQs.
NEW QUESTION # 39
What does the PCI PTS standard cover?
- A. End-to-end encryption solutions for transmission of account data
- B. Development of strong cryptographic algorithms
- C. Secure coding practices for commercial payment applications.
- D. Point-of-interaction devices used to protect account data
Answer: D
Explanation:
Explanation
According to the PCI PTS standard2, point-of-interaction devices used to protect account data are point-of-interaction devices (POI), which are devices that are used to authenticate, authorize, or verify cardholder data or transactions. This is one of the requirements for ensuring that POI devices are used in accordance with PCI DSS.
NEW QUESTION # 40
Which of the following is required to be included in an incident response plan?
- A. Procedures for responding to the detection of unauthorized wireless access points
- B. Procedures for notifying PCI SSC of the security incident
- C. Procedures for launching a reverse-attack on the individual(s) responsible for the security incident
- D. Procedures for securely deleting incident response records immediately upon resolution of the incident
Answer: B
Explanation:
Explanation
PCI DSS Requirement 12.10.1 requires entities to implement an incident response plan that includes roles, responsibilities, and communication and contact strategies for a data security incident, including notification of relevant payment brands1. This is important because each payment card brand has its own policies and procedures for dealing with a security breach, and failing to follow them or meet reporting deadlines could result in fines or loss of authority to process payment card transactions2. Therefore, an incident response plan must include procedures for notifying PCI SSC of the security incident, as well as any other entities that may require notification, whether by contract or law1. References:
Guidance for PCI DSS Scoping and Network Segmentation
Responding to a Cardholder Data Breach
NEW QUESTION # 41
Security policies and operational procedures should be?
- A. Stored securely so that only management has access
- B. Reviewed and updated at least quarterly
- C. Encrypted with strong cryptography
- D. Distributed to and understood by all affected parties
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, security policies and operational procedures should be distributed to and understood by all affected parties, such as management, staff, contractors, vendors, and service providers. This is one of the requirements for ensuring that security policies and operational procedures are communicated and followed consistently.
NEW QUESTION # 42
Which of the following is true regarding compensating controls?
- A. An existing PCI DSS requirement can be used as compensating control if it is already implemented
- B. A compensating control worksheet is not required if the acquirer approves the compensating control
- C. A compensating control is not necessary if all other PCI DSS requirements are in place
- D. A compensating control must address the risk associated with not adhering to the PCI DSS requirement
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a compensating control must address the risk associated with not adhering to a PCI DSS requirement and must be approved by an authorized person before implementation. This is one of the requirements for reducing or eliminating a risk that cannot be eliminated by other means
NEW QUESTION # 43
Where can live PANs be used for testing?
- A. Pre-production environments that are located within the CDE
- B. Pre-production (test) environments only if located outside the CDE.
- C. Production (live) environments only
- D. Testing with live PANs must only be performed in the QSA Company environment
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, pre-production environments that are located within the cardholder data environment can be used for testing, as long as they are not accessible from untrusted networks and are monitored for any changes or vulnerabilities. This is one of the requirements for ensuring that testing environments are isolated from production environments.
NEW QUESTION # 44
Where an entity under assessment is using the customized approach, which of the following steps is the responsibility of the assessor?
- A. Perform the targeted risk analysis as per PCI DSS requirement 12.3.2
- B. Derive testing procedures and document them in Appendix E of the ROC.
- C. Document and maintain evidence about each customized control as defined in Appendix E of PCI DSS
- D. Monitor the control.
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor must derive testing procedures and document them in Appendix E of the ROC. This is one of the requirements for ensuring that testing procedures are defined and documented.
NEW QUESTION # 45
Which of the following is an example of multi-factor authentication?
- A. A token that must be presented twice during the login process
- B. A user passphrase and an application level password.
- C. A user password and a PIN-activated smart card
- D. A user fingerprint and a user thumbprint
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a user password and a PIN-activated smart card is an example of multi-factor authentication. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
NEW QUESTION # 46
Which statement is true regarding the presence of both hashed and truncated versions of the same PAN in an environment?
- A. The hashed and truncated versions must be correlated so the source PAN can be identified
- B. Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions
- C. The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.
- D. Hashed and truncated versions of a PAN must not exist in same environment
Answer: B
Explanation:
Explanation
Hashing is a form of one-way encryption that transforms a data element into a unique fixed-size data element (hash value) without a way to get the original data element from the hash value1. Truncation is a method of rendering the full PAN unreadable by permanently removing a segment of the PAN data2. PCI DSS Requirement 3.4 states that entities must render the PAN unreadable wherever it is stored, using any of the following methods: one-way hashes based on strong cryptography, truncation, index tokens and pads, or strong cryptography with associated key-management processes and procedures3. However, PCI DSS Requirement 3.4e also states that if hashed and truncated versions of the same PAN are present in the environment, additional controls must be in place to ensure that the hashed and truncated versions cannot be correlated to reconstruct the original PAN3. This is because if an attacker obtains both the hashed and truncated versions of the same PAN, they may be able to use a brute-force or dictionary attack to guess the original PAN by hashing and truncating different PAN values until they find a match4. Therefore, the correct answer is option A.
The other options are not true regarding the presence of both hashed and truncated versions of the same PAN in an environment. Option B is not true because PCI DSS does not require the hashed version of the PAN to be also truncated, although it is a recommended best practice to further reduce the risk of exposing the original PAN5. Option C is not true because PCI DSS does not require the hashed and truncated versions to be correlated, as this would defeat the purpose of rendering the PAN unreadable and increase the risk of exposing the original PAN. Option D is not true because PCI DSS does not prohibit the presence of both hashed and truncated versions of the same PAN in the same environment, as long as additional controls are in place to prevent the reconstruction of the original PAN. References:
Protect hashed CardHolder Data according to PCI DSS 3.4 - Advantio
PCI DSS Truncation Rules and Guidelines - Truvantis
PCI DSS v3.2.1
Storing Card Numbers using hashed and truncated version of PAN
pci dss - Credit card data security - hashing, truncation and encryption - Information Security Stack Exchange
NEW QUESTION # 47
According torequirement 1,what is the purpose of "Network Security Controls?
- A. Discover vulnerabilities and rank them
- B. Manage anti-malware throughout the CDE.
- C. Encrypt PAN when stored
- D. Control network traffic between two or more logical or physical network segments.
Answer: D
Explanation:
Explanation
According to requirement 1, network security controls are intended to control network traffic between two or more logical or physical network segments, which means they should prevent unauthorized access, modification, or disclosure of cardholder data or transactions over the network. This is one of the requirements for ensuring that network security controls are implemented and maintained in accordance with PCI DSS.
NEW QUESTION # 48
The intent of assigning a risk ranking to vulnerabilities is to?
- A. Ensure that critical security patches are installed at least quarterly
- B. Replace the need toquarterly ASV scans
- C. Ensure all vulnerabilities are addressed within 30 days
- D. Prioritize the highest risk items so they can be addressed more quickly
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the intent of assigning a risk ranking to vulnerabilities is to prioritize the highest risk items so they can be addressed more quickly, rather than ensuring all vulnerabilities are addressed within 30 days or replacing the need to quarterly ASV scans or ensuring that critical security patches are installed at least quarterly. This is one of the requirements for ensuring that vulnerabilities are identified and mitigated as soon as possible.
NEW QUESTION # 49
An LDAP server providing authentication services to the cardholder data environment is
- A. in scope only if it provides authentication services to systems in the DMZ
- B. in scope only if it stores processes or transmits cardholder data
- C. in scope for PCI DSS.
- D. not in scope for PCI DSS
Answer: B
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an LDAP server providing authentication services to the cardholder data environment is in scope only if it provides authentication services to systems in the DMZ. This is one of the requirements for preventing unauthorized access to cardholder data.
NEW QUESTION # 50
A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?
- A. Disable any firewall functions that are not needed in production
- B. Remove the default 'Firewall Administrator account and create a shared account for firewall administrators to use.
- C. Configure the firewall to permit all traffic until additional rules are defined
- D. Synchronize the firewall rules with the other firewalls m the environment
Answer: A
Explanation:
Explanation
One of the best practices for hardening a firewall is to disable any firewall functions that are not needed in production, such as unused services, ports, protocols, or features. This reduces the attack surface and minimizes the potential for exploitation. According to the PCI Card Production Logical Security Requirements, section 3.2.1, "The firewall must be configured to deny all traffic by default and allow only traffic that is explicitly required for the card production environment." Furthermore, section 3.2.2 states, "The firewall must be configured to block all unnecessary services, ports, protocols, and IP addresses." References: PCI Card Production Logical Security Requirements, Card Production Security Assessor - Logical - Credly
NEW QUESTION # 51
An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA. During the assessment, you spend time completing the Controls Matrix and the TRA. while also ensuing that the customized control is implemented securely. Which of the following statements is true?
- A. Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA.
- B. You can assess the customized control but another assessor must verify that you completed the TRA correctly.
- C. You can assess the customized control and verify that the customized approach was correctly followed but you must document this in the ROC.
- D. You must document the work on the customized control in the ROC but you can not assess the control or the documentation.
Answer: C
Explanation:
Explanation
The customized approach is a new option in PCI DSS v4.0 that allows entities to use alternate security controls or new technologies that meet the PCI DSS Customized Approach Objective for a requirement1. The customized approach requires the entity to complete and document a Controls Matrix and a Targeted Risk Analysis (TRA) for each customized control, and to provide this documentation to the assessor2. The assessor's role is to review the documentation, assess the customized control, and verify that the customized approach was correctly followed3. The assessor must also document the assessment of the customized control in the Report on Compliance (ROC), using the ROC Template provided by PCI SSC4. Therefore, the correct answer is option B.
The other options are not true regarding the role of the assessor in the customized approach. Option A is not true because the assessor does not need another assessor to verify the TRA, as the assessor is responsible for reviewing and validating the TRA as part of the assessment process3. Option C is not true because the assessor can and must assess the control and the documentation, as well as document the work on the customized control in the ROC34. Option D is not true because the assessor is allowed to assist the entity with the completion of the Controls Matrix or the TRA, as long as the assessor does not design, develop, or implement the customized control for the entity5. References:
PCI DSS v4.0: Is the Customized Approach Right For Your Organization?
PCI DSS v4.0: Roles and Responsibilities for the Customized Approach
PCI DSS v4.0 Report on Compliance Template
PCI DSS v4.0
PCI DSS v4.0: Customized Approach Explained
NEW QUESTION # 52
What must be included m an organization's procedures for managing visitors?
- A. Visitors are escorted at all times within areas where cardholder data is processed or maintained
- B. Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit
- C. Visitor log includes visitor name, address, and contact phone number
- D. Visitor badges are identical to badges used by onsite personnel
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, visitors are escorted at all times within areas where cardholder data is processed or maintained, visitor badges are identical to badges used by onsite personnel, visitor log includes visitor name, address, and contact phone number, visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit. These are some examples of procedures that must be included in an organization's procedures for managing visitors who access in-scope systems where cardholder data is processed or maintained.
NEW QUESTION # 53
......
Free PCI Qualified Professionals Assessor_New_V4 Exam Question: https://www.examtorrent.com/Assessor_New_V4-valid-vce-dumps.html
Assessor_New_V4 dumps & PCI Qualified Professionals sure practice dumps: https://drive.google.com/open?id=1Mlc2c3Pmow-xvhMzAxkbCnEUm4ggpgn4
