PCIP All Answers Correct

PCIP All Answers Correct Requirement 1 Ans- Install and maintain a firewall configuration to protect cardholder data Requirement 2 Ans- Do not use vendor supplied defaults for system passwords and other security parameters Requirement 3 Ans- Protect stored cardholder data by enacting a formal data retention policy and implement secure deletion methods Requirement 4 Ans- Encrypt transmission of cardholder data across open, public networks Requirement 5 Ans- Protect all systems against malware and regularly update anti-virus software or programs Requirement 6 Ans- Develop and maintain secure systems and applications Requirement 7 Ans- Restrict access to cardholder data by business need to know Requirement 8 Ans- Identify and authenticate access to system components Requirement 9 Ans- Restrict physical access to cardholder data Requirement 10 Ans- Track and monitor all access to network resources and cardholder data Requirement 11 Ans- Regularly test security systems and processes Requirement 12 Ans- Maintain a policy that addresses information security for all personnel Appendix A1 Ans- Shared hosting providers must protect the cardholder data environment Appendix A2 Ans- Additional PCI DSS Requirements for Entities using SSL/early TLS Appendix A3 Ans- Designated Entities Supplemental Validation (DESV) Compensating Controls Ans- 1- Meet the intent and rigor of the original PCI requirement 2- Sufficiently offset the risk that the original PCI DSS requirement was designed to defend against 3- Be "above and beyond" other PCI DSS requirements (i.e., not simply in compliance with other requirements) 4- Be commensurate with additional risk imposed by not adhering to original requirement Compensating Controls - Ans- To consider Compensating Controls, one of the following must exist that precludes implementing the stated control: 1- Legitimate Technical Constraint 2- Documented Business Constraint Compensating Controls : Ans- Existing PCI DSS requirements CANNOT be considered as compensating controls if they are already required for the Compensating Controls ... Ans- Existing PCI DSS requirements may be combined with new controls to become a compensating control SAQs Ans- is a validation tool intended to assist merchants and service providers in self-evaluating their compliance with the PCI DSS SAQ A Ans- Card-Not-Present (e-commerce or MO/TO) merchants, all cardholder data functions outsourced to PCI DSS compliant service providers. Not applicable to face-to-face channels. SAQ A-EP Ans- E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn't directly receive cardholder data but that can impact the security of the payment transaction. No electronic storage, processing, or transmission of any cardholder data on the merchant's systems or premises. Applicable only to e-commerce channels. SAQ B Ans- Imprint-only merchants with no electronic cardholder data storage, or standalone, dial-out terminal merchants with no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ B-IP Ans- Merchants using only stand-alone, PTS-approved payment terminals with an IP connection to the payment processor, with no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ C Ans- Merchants with segmented payment application systems connected to the Internet, with no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ C-VT Ans- Merchants using only web-based virtual payment terminals, with no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ D Ans- SAQ D for Merchants: All merchants not included in the descriptions for other SAQ types. SAQ D for Service Providers: All service providers identified by a payment brands as eligible to complete a self-assessment questionnaire. P2PE Ans- Merchants who have implemented a validated Point-to-Point Encryption Solution that is listed on the PCI SSC website, with no electronic cardholder data storage. Not applicable to e-commerce channels Prioritize Approach Goal #1 Ans- Remove sensitive authentication data and limit data retention Intent: Remove SAD & limit data retention Prioritize Approach Goal #2 Ans- Protect systems and networks, and be prepared to respond to a system breach Intent: Controls for point of access and processes for responding Prioritize Approach Goal #3 Ans- Secure payment card applications Intent: Controls for applications, application processes, and application serv