[Nov 17, 2023] New Assessor_New_V4 Exam Dumps with High Passing Rate [Q10-Q34]

Q10. According to the glossary, bespoke and custom software describes which type of software?

Any software developed by a third party

Any software developed by a third party that can be customized by an entity.

Software developed by an entity for the entity’s own use

Virtual payment terminals

Q11. Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?

The retired key must not be used for encryption operations

Cryptographic key components from the retired key must be retained for 3 months before disposal

A new key custodian must be assigned

All data encrypted under the retired key must be securely destroyed

Q12. Which of the following types of events is required to be logged?

All use of end-user messaging technologies

All access to external web sites

All access to all audit trails

All network transmissions

Q13. A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?

Remove the default ‘Firewall Administrator account and create a shared account for firewall administrators to use.

Configure the firewall to permit all traffic until additional rules are defined

Synchronize the firewall rules with the other firewalls m the environment

Disable any firewall functions that are not needed in production

Q14. An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are assigned only to administrative groups and not to regular users

A different certificate is assigned to each individual user account, and certificates are not shared

Certificates are logged so they can be retrieved when the employee leaves the company

Change control processes are in place to ensue certificates are changed every 90 days

Q15. What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?

The security protocol is configured to support earlier versions

The PAN is encrypted with strong cryptography

The security protocol is configured to accept all digital certificates

The PAN is securely deleted once the transmission has been sent

Q16. What do PCI DSS requirements for protecting cryptographic keys include?

Public keys must be encrypted with a key-encrypting key.

Data-encrypting keys must be stronger than the key-encrypting key that protects it.

Private or secret keys must be encrypted, stored within an SCD or stored as key components

Key-encrypting keys and data-encrypting keys must be assigned to the same key custodian

Q17. What must be included m an organization’s procedures for managing visitors9

Visitor log includes visitor name, address, and contact phone number

Visitor badges are identical to badges used by onsite personnel

Visitors are escorted at all times within areas where cardholder data is processed or maintained

Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit

Q18. The intent of assigning a risk ranking to vulnerabilities is to?

Ensure all vulnerabilities are addressed within 30 days

Replace the need toquarterly ASV scans

Prioritize the highest risk items so they can be addressed more quickly

Ensure that critical security patches are installed at least quarterly

Q19. An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are logged so they can be retrieved when the employee leaves the company

Change control processes are in place to ensue certificates are changed every 90 days

Certificates are assigned only to administrative groups and not to regular users

A different certificate is assigned to each individual user account, and certificates are not shared

Q20. A sample of business facilities is reviewed during the PCI DSS assessment What is the assessor required to validate about the sample?

It includes a consistent set of facilities that are reviewed for all assessments.

The number of facilities in the sample is at least 10 percent of the total number of facilities

Every facility where cardholder data is stored is reviewed

All types and locations of facilities are represented

Q21. Security policies and operational procedures should be?

Encrypted with strong cryptography

Stored securely so that only management has access

Reviewed and updated at least quarterly

Distributed to and understood by all affected parties

Q22. At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?

Authorization

Clearing

Settlement

Chargeback

Q23. An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

Q24. Which of the following can be sampled for testing during a PCI DSS assessment?

PCI DSS requirements and testing procedures.

Compensating controls

Business facilities and system components

Security policies and procedures

Q25. Which statement about PAN is true?

It must be protected with strong cryptography for transmission over private wireless networks

It must be protected with strong cryptography (or transmission over private wired networks

It does not require protection for transmission over public wireless networks

It does not require protection for transmission over public wired networks

Q26. If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?

Verify the segmentation controls allow only necessary traffic into the cardholder data environment.

Verify the payment card brands have approved the segmentation

Verify that approved devices and applications are used for the segmentation controls

Verify the controls used for segmentation are configured properly and functioning as intended

Q27. Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

Q28. In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place”?

Details of the entity s project plan for implementing the requirement

Details of how the assessor observed the entity s systems were compliant with the requirement

Details of the entity s reason for not implementing the requirement

Details of how the assessor observed the entity s systems were not compliant with the requirement

Q29. Which of the following describes the intent of installing one primary function per server?

To allow functions with different security levels to be implemented on the same server

To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server

To allow higher-security functions to protect lower-security functions installed on the same server

To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

Q30. In accordance with PCI DSS Requirement 10. how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available

At least 2 years, with the most recent 3 months immediately available

At least 2 years with the most recent month immediately available

At least 3 months with the most recent month immediately available

Q31. Which statement is true regarding the use of intrusion detection techniques, such as intrusion detection systems and/or intrusion protection systems (IDS’IPS)?

Intrusion detection techniques are required on all system components

Intrusion detection techniques are required to alert personnel of suspected compromises

Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems

Intrusion detection techniques are required to identify all instances of cardholder data

Q32. an entity under assessment is using the customized approach, which of the following steps is the responsibility of the assessor?

Monitor the control.

Derive testing procedures and document them in Appendix E of the ROC.

Document and maintain evidence about each customized control as defined in Appendix E of PCI DSS

Perform the targeted risk analysis as per PCI DSS requirement 12.3.2

Q33. Which of the following is true regarding internal vulnerability scans?

They must be performed after a significant change

They must be performed by an Approved Scanning Vendor (ASV)

They must be performed by QSA personnel

They must be performed at least annually

Q34. An entity accepts e-commerce payment card transactions and stores account data in a database The database server and the web server are both accessible from the Internet The database server and the web server are on separate physical servers. What is required for the entity to meet PCI DSS requirements7

The web server and the database server should be installed on the same physical server

The database server should be relocated so that it is not accessible from untrusted networks

The web server should be moved into the internal network

The database server should be moved to a separate segment from the web server to allow for more concurrent connections

Latest Exams Dumps & Reviews

[Nov 17, 2023] New Assessor_New_V4 Exam Dumps with High Passing Rate [Q10-Q34]

examdumps

Leave a Reply Cancel reply