1 | P a g e | © copyright 2024/2025 | Grade A+
AQSA Certification Questions & 100%
Correct Answers
PCI SSC
✓ ~~> is an independent industry standards body providing oversights
of the development and management of Payment Card Industry Data
Security Standards on a global basis.
What are the founding payment brands?
✓ ~~> American express, Discover, JCB, Mastercard, and VISA
What define the merchant levels?
✓ ~~> defined by the payment brands, based on transaction volume.
Transaction volume determined by the acquirer)
What define the service provider levels?
✓ ~~> Defined by the payment brands according to transaction
volume and/or type of service provider. Determined by the payment
brans or acquirer, or sometimes the service provider.
SAQ-A
Master01 | September, 2024/2025 | Latest update
, 2 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> Card-not-present merchants (e-commerce or mail/telephone-
order) that have fully outsourced all cardholder data functions to PCI
DSS validated third-part service providers, with no electronic storage,
processing, or transmission of any cardholder data on the merchant's
systems or premises.
SAQ A-EP
✓ ~~> E-commerce merchants who outsource all payment processing
to PCI DSS validated third parties, and who have a website(s) that
doesn't directly receive cardholder data but that can impact the
security of the payment transaction. No electronic storage, processing,
or transmission of any cardholder data on the merchant's systems or
premises.
SAQ-B
✓ ~~> Merchants using only:
- Imprint machines with no electronic cardholder data storage; and/or
- Standalone, dial-out terminals with no electronic cardholder data storage.
SAQ-B-IP
Master01 | September, 2024/2025 | Latest update
, 3 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> Merchants using only stand-alone, PTS-approved payment
terminals with an IP connection to the payment processor, with no
electronic cardholder data storage.
Not applicable to e-commerce channels.
SAQ C-VT
✓ ~~> is for merchants using only web-based virtual payment terminals,
where cardholder data is manually entered into a secure website from
a single system.
SAQ-C
✓ ~~> is for merchants with dedicated payment application systems
segmented from all other systems, and connected to the Internet for
the purposes of transaction processing. SAQ C is not applicable to e-
commerce payment channels. A merchant only accepts payments via
the telephone and they enter the cardholder data directly into a
webpage provided by their acquirer.
PCI DSS
Master01 | September, 2024/2025 | Latest update
, 4 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> covers security of the environments that store, process, or
transmit account data. The scope of PCI DSS covers environments
receiving account data from payment applications and other
sources—acquirers, for example.
PCI PA-DSS
✓ ~~> covers secure payment applications to support PCI DSS
compliance. The scope of PA-DSS addresses when a payment
application receives account data from cardholder-interface devices
such as point-of sale-terminals or other devices and begins the
payment transaction.
PCI P2PE (Point-to-Point Encryption)
✓ ~~> covers secure encryption, decryption, and key management for
point-to-point encryption solutions. Requirements for a P2PE solution will
vary depending on the deployment environment and the technologies
used for a specific implementation.
PCI PTS (PIN Transaction Security) POI
Master01 | September, 2024/2025 | Latest update
AQSA Certification Questions & 100%
Correct Answers
PCI SSC
✓ ~~> is an independent industry standards body providing oversights
of the development and management of Payment Card Industry Data
Security Standards on a global basis.
What are the founding payment brands?
✓ ~~> American express, Discover, JCB, Mastercard, and VISA
What define the merchant levels?
✓ ~~> defined by the payment brands, based on transaction volume.
Transaction volume determined by the acquirer)
What define the service provider levels?
✓ ~~> Defined by the payment brands according to transaction
volume and/or type of service provider. Determined by the payment
brans or acquirer, or sometimes the service provider.
SAQ-A
Master01 | September, 2024/2025 | Latest update
, 2 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> Card-not-present merchants (e-commerce or mail/telephone-
order) that have fully outsourced all cardholder data functions to PCI
DSS validated third-part service providers, with no electronic storage,
processing, or transmission of any cardholder data on the merchant's
systems or premises.
SAQ A-EP
✓ ~~> E-commerce merchants who outsource all payment processing
to PCI DSS validated third parties, and who have a website(s) that
doesn't directly receive cardholder data but that can impact the
security of the payment transaction. No electronic storage, processing,
or transmission of any cardholder data on the merchant's systems or
premises.
SAQ-B
✓ ~~> Merchants using only:
- Imprint machines with no electronic cardholder data storage; and/or
- Standalone, dial-out terminals with no electronic cardholder data storage.
SAQ-B-IP
Master01 | September, 2024/2025 | Latest update
, 3 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> Merchants using only stand-alone, PTS-approved payment
terminals with an IP connection to the payment processor, with no
electronic cardholder data storage.
Not applicable to e-commerce channels.
SAQ C-VT
✓ ~~> is for merchants using only web-based virtual payment terminals,
where cardholder data is manually entered into a secure website from
a single system.
SAQ-C
✓ ~~> is for merchants with dedicated payment application systems
segmented from all other systems, and connected to the Internet for
the purposes of transaction processing. SAQ C is not applicable to e-
commerce payment channels. A merchant only accepts payments via
the telephone and they enter the cardholder data directly into a
webpage provided by their acquirer.
PCI DSS
Master01 | September, 2024/2025 | Latest update
, 4 | P a g e | © copyright 2024/2025 | Grade A+
✓ ~~> covers security of the environments that store, process, or
transmit account data. The scope of PCI DSS covers environments
receiving account data from payment applications and other
sources—acquirers, for example.
PCI PA-DSS
✓ ~~> covers secure payment applications to support PCI DSS
compliance. The scope of PA-DSS addresses when a payment
application receives account data from cardholder-interface devices
such as point-of sale-terminals or other devices and begins the
payment transaction.
PCI P2PE (Point-to-Point Encryption)
✓ ~~> covers secure encryption, decryption, and key management for
point-to-point encryption solutions. Requirements for a P2PE solution will
vary depending on the deployment environment and the technologies
used for a specific implementation.
PCI PTS (PIN Transaction Security) POI
Master01 | September, 2024/2025 | Latest update
