PCI FUNDAMENTALS FINAL PAPER 2026
COMPLETE QUESTIONS AND ANSWERS
VERIFIED A+
◉ The role of the Internal Security Assessor (ISA) does not include:
Answer: Produce the final Report on Compliance (ROC). The ISA
produces the SAQ, a QSA produces the ROC.
◉ Who should receive the completed SAQ?:
Answer: The acquiring bank or payment brand(s)
◉ With respect to Requirement 11.2, when working with an
approved scanning vendor, an ISA must:
Answer: Provide all IP ranges and domains of the external scanned
environment
◉ The purpose of a Qualified Integrator and Reseller (QIR) reseller
does not include:
Answer: Being qualified to assess payment applications against the
PA-DSS standard
◉ A "Merchant Bank" is commonly referred to as:
, Answer: An Acquirer
◉ A Hosting Provider:
Answer: Offers various services to merchants and other service
providers
◉ One process that must be included when changing the cardholder
data environment are:
Answer: Policies and procedures must define: A separation of duties
between personnel assigned to the development/test environments
and those assigned to the production environment
◉ Which aspect of PCI DSS is not required of an ISA?:
Answer: Development and enforcement of compliance programs
◉ To meet PCI DSS Requirement 1.2.1, an entity may install a
network firewall between the CDE and corporate network to ensure
only designated systems in the corporate network can communicate,
via approved ports, to systems in the CDE. This is an example of:
Answer: Segmentation
◉ GPRS Refers to:
Answer: Acronym for "General Packet Radio Service." Mobile data
service available to users of GSM mobile phones.
COMPLETE QUESTIONS AND ANSWERS
VERIFIED A+
◉ The role of the Internal Security Assessor (ISA) does not include:
Answer: Produce the final Report on Compliance (ROC). The ISA
produces the SAQ, a QSA produces the ROC.
◉ Who should receive the completed SAQ?:
Answer: The acquiring bank or payment brand(s)
◉ With respect to Requirement 11.2, when working with an
approved scanning vendor, an ISA must:
Answer: Provide all IP ranges and domains of the external scanned
environment
◉ The purpose of a Qualified Integrator and Reseller (QIR) reseller
does not include:
Answer: Being qualified to assess payment applications against the
PA-DSS standard
◉ A "Merchant Bank" is commonly referred to as:
, Answer: An Acquirer
◉ A Hosting Provider:
Answer: Offers various services to merchants and other service
providers
◉ One process that must be included when changing the cardholder
data environment are:
Answer: Policies and procedures must define: A separation of duties
between personnel assigned to the development/test environments
and those assigned to the production environment
◉ Which aspect of PCI DSS is not required of an ISA?:
Answer: Development and enforcement of compliance programs
◉ To meet PCI DSS Requirement 1.2.1, an entity may install a
network firewall between the CDE and corporate network to ensure
only designated systems in the corporate network can communicate,
via approved ports, to systems in the CDE. This is an example of:
Answer: Segmentation
◉ GPRS Refers to:
Answer: Acronym for "General Packet Radio Service." Mobile data
service available to users of GSM mobile phones.
