PCI SSC Qualified Security Assessor V4 - QSA_New_V4 模擬練習

A. A ROC that has been completed after using an SAQ to determine which requirements should be tested, as per FAQ 1331.

B. A term used by payment brands and acquirers to describe entities that have multiple payment channels, with each channel having its own assessment.

C. An interim result before the final ROC has been completed.

D. An assessment with at least one requirement marked as "Not Tested".

A. Ensuring that media is clearly and visibly labeled as "Confidential" so all personnel know that the media contains cardholder data.

B. Ensuring that media containing cardholder data is moved from secured areas on a quarterly basis.

C. Ensuring that all media is consistently destroyed on the same schedule, regardless of the contents.

D. Ensuring that media is properly protected according to the sensitivity of the data it contains.

A. At least 3 months, with the most recent month immediately available.

B. At least 1 year, with the most recent 3 months immediately available.

C. At least 2 years, with the most recent month immediately available.

D. At least 2 years, with the most recent 3 months immediately available.

A. Files that regularly change

B. Security policy and procedure documents

C. Application vendor manuals

D. System configuration and parameter files

A. Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems.

B. Intrusion detection techniques are required on all system components.

C. Intrusion detection techniques are required to alert personnel of suspected compromises.

D. Intrusion detection techniques are required to identify all instances of cardholder data.

A. Each internal system peers directly with an external source to ensure accuracy of time updates.

B. Access to time configuration settings is available to all users of the system.

C. Each internal system is configured to be its own time server.

D. Central time servers receive time signals from specific, approved external sources.

A. A user passphrase and an application-level password.

B. A user password and a PIN-activated smart card.

C. A user fingerprint and a user thumbprint.

D. A token that must be presented twice during the login process.

A. Device identifiers and security labels are periodically replaced.

B. The serial number of each device is periodically verified with the device manufacturer.

C. Devices are physically destroyed if there is suspicion of compromise.

D. Devices are periodically inspected to detect unauthorized card skimmers.