Try Free and Start Using Realistic Verified Assessor_New_V4 Dumps Instantly
Assessor_New_V4 Actual Questions - Instant Download 62 Questions
NEW QUESTION # 14
What process is requited by PCI DSS (or protecting card-reading devices at the point-of-sale?
- A. Devices are periodically inspected to detect unauthorized card stammers.
- B. Device identifiers and security labels are periodically replaced
- C. The serial number of each device is periodically verified with the device manufacturer
- D. Devices are physically destroyed if there is suspicion of compromise
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, devices are periodically inspected to detect unauthorized card stammers using physical inspection or other methods such as software-based tools or network-based tools (such as firewalls). This is one of the requirements for preventing card skimming attacks that could compromise cardholder data.
NEW QUESTION # 15
According torequirement 1,what is the purpose of "Network Security Controls?
- A. Encrypt PAN when stored
- B. Manage anti-malware throughout the CDE.
- C. Control network traffic between two or more logical or physical network segments.
- D. Discover vulnerabilities and rank them
Answer: C
Explanation:
Explanation
According to requirement 1, network security controls are intended to control network traffic between two or more logical or physical network segments, which means they should prevent unauthorized access, modification, or disclosure of cardholder data or transactions over the network. This is one of the requirements for ensuring that network security controls are implemented and maintained in accordance with PCI DSS.
NEW QUESTION # 16
Could an entity use both the Customized Approach and the Defined Approach to meet the same requirement?
- A. Yes if the entity is eligible to use both approaches
- B. No. because only compensating controls can be used with the Defined Approach
- C. No because a single approach must be selected
- D. Yes if the entity uses no compensating controls
Answer: D
Explanation:
Explanation
an entity can use both the Customized Approach and the Defined Approach to meet the same requirement, as long as it uses compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.
NEW QUESTION # 17
In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place''?
- A. Details of the entity s project plan for implementing the requirement
- B. Details of the entity s reason for not implementing the requirement
- C. Details of how the assessor observed the entity s systems were not compliant with the requirement
- D. Details of how the assessor observed the entity s systems were compliant with the requirement
Answer: D
Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity's systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.
NEW QUESTION # 18
Viewing of audit log files should be limited to?
- A. Individuals with administrator privileges
- B. Individuals with a job-related need
- C. Individuals who performed the logged activity
- D. Individuals with read/write access
Answer: B
Explanation:
Explanation
According to requirement 4, viewing of audit log files should be limited to individuals with a job-related need, which means they should only access the audit log files for legitimate purposes related to their job functions.
This is one of the requirements for ensuring that audit log files are not accessed by unauthorized or unnecessary personnel.
NEW QUESTION # 19
Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?
- A. Application vendor manuals
- B. System configuration and parameter files
- C. Security policy and procedure documents
- D. Files that regularly change
Answer: B
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, system configuration and parameter files must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool). This is one of the requirements for ensuring that changes to system configuration and parameter files are detected and verified.
NEW QUESTION # 20
An entity is using custom software in their CDE.The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard.What impact will this have on the entity's PCI DSS assessment?
- A. It automatically makes an entity PCI DSS compliant
- B. It may help the entity to meet several requirements in Requirement 6.
- C. The custom software can be excluded from the PCI DSS assessment
- D. There is no impact to the entity
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, there is no impact to the entity if custom software in their CDE was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard. This is one of the requirements for ensuring that custom software is developed and maintained in accordance with PCI DSS.
NEW QUESTION # 21
Assigning a unique ID to each person is intended to ensure?
- A. Shared accounts are only used by administrators
- B. Individual users are accountable for their own actions
- C. Access is assigned to group accounts based on need-to-know
- D. Strong passwords are used for each user account
Answer: B
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, individual users are accountable for their own actions, which means they should use strong passwords, change them regularly, and not share them with anyone else. This is one of the requirements for ensuring that user accounts are properly managed and controlled.
NEW QUESTION # 22
A retail merchant has a server room containing systems that store encrypted PAN data. The merchant has implemented a badge access-control system that identities who entered and exited the room onwhat date and at what time There are no video cameras located in the server room Based on this information, which statement is true regarding PCI DSS physical security requirements?
- A. The merchant must install motion-sensing alarms in addition to the existing access-control system
- B. The badge access-control system must be protected from tampering or disabling
- C. The merchant must install video cameras in addition to the existing access-control system
- D. Data from the access-control system must be securely deleted on a monthly basis
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, based on this information, which statement is true regarding PCI DSS physical security requirements? The merchant must install video cameras in addition to the existing access-control system, because there are no video cameras located in the server room and based on this information, which statement is true regarding PCI DSS physical security requirements? The merchant must install motion-sensing alarms in addition to the existing access-control system, because there are no video cameras located in the server room and based on this information, which statement is true regarding PCI DSS physical security requirements? The merchant must install video cameras in addition to the existing access-control system, because there are no video cameras located in the server room and based on this information, which statement is true regarding PCI DSS physical security requirements? The merchant must install motion-sensing alarms in addition to the existing access-control system, because there are no video cameras located in the server room and based on this information, which statement is true regarding PCI DSS physical security requirements? The merchant must install video cameras in addition to the existing access-control system, because there are no video cameras located in
NEW QUESTION # 23
According to the glossary, bespoke and custom software describes which type of software?
- A. Any software developed by a third party
- B. Software developed by an entity for the entity's own use
- C. Virtual payment terminals
- D. Any software developed by a third party that can be customized by an entity.
Answer: B
Explanation:
Explanation
According to the glossary, bespoke and custom software describes software developed by an entity for its own use, which means it should not be shared with other entities or sold or transferred without proper authorization. This is one of the requirements for ensuring that bespoke and custom software meets all the security standards and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1.
NEW QUESTION # 24
What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?
- A. The security protocol is configured to support earlier versions
- B. The PAN is encrypted with strong cryptography
- C. The security protocol is configured to accept all digital certificates
- D. The PAN is securely deleted once the transmission has been sent
Answer: B
Explanation:
Explanation
when PAN is sent over the Internet, PAN must be encrypted with strong cryptography, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 25
An LDAP server providing authentication services to the cardholder data environment is
- A. in scope for PCI DSS.
- B. in scope only if it provides authentication services to systems in the DMZ
- C. in scope only if it stores processes or transmits cardholder data
- D. not in scope for PCI DSS
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an LDAP server providing authentication services to the cardholder data environment is in scope only if it provides authentication services to systems in the DMZ. This is one of the requirements for preventing unauthorized access to cardholder data.
NEW QUESTION # 26
Which statement is true regarding the PCI DSS Report on Compliance (ROC)?
- A. The ROC Reporting Template provided by PCI SSC is only required for service provider assessments
- B. The assessor must create their own ROC template for each assessment report
- C. The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC
- D. The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor may use either their own template or the ROC Reporting Template provided by PCI SSC. This is one of the requirements for ensuring consistency and accuracy in ROCs.
NEW QUESTION # 27
Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?
- A. Virtual LANs that route network traffic between the CDE and out-of-scope networks
- B. A network configuration that prevents all network traffic between the CDE and out-of-scope networks
- C. Routers that monitor network traffic flows between the CDE and out-of-scope networks
- D. Firewalls that log all network traffic flows between the CDE and out of-scope networks
Answer: B
Explanation:
Explanation
According to requirement 3.1.2, a network configuration that prevents all network traffic between the cardholder data environment and out-of-scope networks can be used as a segmentation approach for reducing PCI DSS scope, which means it should isolate each customer's cardholder data from other customers' cardholder data and prevent unauthorized access or disclosure. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
NEW QUESTION # 28
Which statement is true regarding the presence of both hashed and truncated versions ofthe same PAN in an environment?
- A. Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions
- B. Hashed and truncated versions of a PAN must not exist in same environment
- C. The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.
- D. The hashed and truncated versions must be correlated so the source PAN can be identified
Answer: B
Explanation:
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, the hashed and truncated versions of the same PAN must not exist in the same environment, which means they should not be stored or transmitted together. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 29
Which of the following is an example of multi-factor authentication?
- A. A token that must be presented twice during the login process
- B. A user passphrase and an application level password.
- C. A user password and a PIN-activated smart card
- D. A user fingerprint and a user thumbprint
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a user password and a PIN-activated smart card is an example of multi-factor authentication. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
NEW QUESTION # 30
An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?
- A. Change control processes are in place to ensue certificates are changed every 90 days
- B. Certificates are assigned only to administrative groups and not to regular users
- C. A different certificate is assigned to each individual user account, and certificates are not shared
- D. Certificates are logged so they can be retrieved when the employee leaves the company
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a different certificate is assigned to each individual user account, and certificates are not shared. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
NEW QUESTION # 31
At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?
- A. Clearing
- B. Authorization
- C. Chargeback
- D. Settlement
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, settlement occurs when a merchant receives payment from a card issuer for a completed transaction and delivers goods or services to a customer or another party as agreed upon in advance by both parties, subject to any conditions imposed by either party upon delivery or payment, including but not limited to acceptance, rejection, return, exchange, refund, cancellation, modification, suspension, termination or revocation by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment;
NEW QUESTION # 32
A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?
- A. Configure the firewall to permit all traffic until additional rules are defined
- B. Synchronize the firewall rules with the other firewalls m the environment
- C. Remove the default 'Firewall Administrator account and create a shared account for firewall administrators to use.
- D. Disable any firewall functions that are not needed in production
Answer: B
Explanation:
Explanation
According to requirement 3.1.2, a network firewall should be configured to permit only traffic that is necessary for its operation and security, which means it should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
NEW QUESTION # 33
......
Download Free Latest Exam Assessor_New_V4 Certified Sample Questions: https://officialdumps.realvalidexam.com/Assessor_New_V4-real-exam-dumps.html
