Payment Card Industry Professional PCIP3.0 Valid Study Guide

1. What is the Appendix A on PCI DSS 3.0?

2. Develop and maintain secure systems and applications is the _________

3. Methods for stealing payment card data include:

4. Internal and external penetration tests should be performed_______________ to meet requirement 11.3.1 and 11.3.2

5. Payment cards has typically 2 tracks, track 1 and track 2 that has respectively how many characters in length?

6. Requirement 11.3 C Implement a methodology for penetration testing is a best practice until June 30 2015

7. Restrict access to cardholder data by business need-to-know

8. Information Security Policies must be reviewed/updated _____________ to meet requirement 12.1.1

9. Requirement 2.2.2 and 2.2.3 cover the use of secure services, protocols, and daemons as required for the function of a system. Which of the following is considered secure?

10. Intrusion-detection and/or intrusion-prevention techniques are NOT a requirement to monitor all traffic at the perimeter of the cardholder data environment as well as at critical points in the CDE and alert personnel to suspected compromises.

11. Compensating controls must: (Select ALL that applies)

12. Internal and external vulnerability scans should run at minimum on every __________ to meet requirement 11.2

13. In the event of a violation of the PCIP Qualification Requirements, disciplinary actions for PCIPs could include:

14. In order to be considered a compensating control, which of the following must exist:

15. SELECT ALL THAT APPLY
To be compliant with requirement 9.9 an updated list of all card-reading devices used in card-present transactions at the point of sale must be kept by June 30 2015 including the following:

16. The use of Tokenization can eliminate the need for PCI Compliance

17. Existing PCI DSS requirements may be combined with new controls to become a compensating control.

18. The use of two-factor authentication is NOT a requirement on PCI DSS v3 for remote network access originating from outside the network by personnel and all third parties.

19. For initial PCI DSS compliance, it’s not required that four quarters of passing scans must be completed if the assessor verifies that 1) the most recent scan result was a passing scan, 2) the entity has documented policies and procedures requiring quarterly scanning, and 3) vulnerabilities noted in the scan results have been corrected as shown in a re-scan(s).

20. Imprint-Only Merchants with no electronic storage of cardholder data may be eligible to use which SAQ?