PCI DSS 3.2.1 EXAM QUESTIONS WITH
CORRECT ANSWERS
Which |of |the |following |does |not |belong?
The |following |events |should |be |included |in |automated |audit |trails |for |all |system |component:
-Individual |access |to |cardholder |data
-Creation |and |deletion |of |system-level |objects
-Invalid |logical |access |attempts
-Actions |taken |by |user |with |root |or |administrative |privileges
-Changes, |additions, |or |deletions |to |any |account |with |root |or |administrative |privileges
-Audit |trail |access
-Use |of |identification |and |authentication |mechanisms
-Elevation |of |privileges
-Initialization |of |audit |logs
-Stopping |or |pausing |of |audit |logs |- |CORRECT |ANSWER✔✔-All |of |these |should |be |included. |
(Requirement |10.2.1 |- |10.2.7)
Which |of |the |following |does |not |belong?
The |following |audit |trail |entries |should |be |recorded |for |each |event:
-User |identification
-Type |of |event
-Date |and |time
-Success |or |failure
-Origination |of |event
,-Identity |of |name |of |affected |data, |system |component, |or |resource
-Initializing, |stopping, |or |pausing |of |audit |logs |- |CORRECT |ANSWER✔✔-Initializing, |stopping, |or
|pausing |of |audit |logs |- |this |choice |is |part |of |what |should |be |included |in |audit |logs |(10.2)
This |question |pertains |to |10.3 |(10.3.1 |- |10.3.6)
How |often |should |logs |and |security |event |reviews |be |conducted? |- |CORRECT |ANSWER✔✔-At |
least |daily |(10.6)
How |long |should |audit |trail |history |be |retained?
At |least |___ |of |history |must |be |immediately |available |for |analysis. |- |CORRECT |ANSWER✔✔-At |
least |1 |year |retained
3 |months
(10.7)
How |long |should |visitor |logs |for |physical |access |be |retained? |- |CORRECT |ANSWER✔✔-At |least |
3 |months |(9.4)
Critical |patches |need |to |installed |within |___ |of |release. |- |CORRECT |ANSWER✔✔-One |month
For |public-facing |web |applications, |which |of |the |following |is |required?
-Web |application |firewalls
-Manual |vulnerability |assessment |tools
-Automated |vulnerability |assessment |tools |- |CORRECT |ANSWER✔✔-Any |one |or |more |of |these.
|According |to |Requirement |6.6, |ensure |that |either |one |of |the |following |methods |is |in |place:
, 1. |Web |application |firewalls |- |Examine |system |configuration |settings |to |verify |an |automated |
technical |solution |that |detects |and |prevents |web-based |attacks |is |in |place.
2. |Web |application |assessment |- |Verify |that |public-facing |web |applications |are |reviewed |using |
with |manual |or |automated |vulnerability |assessment |tools |or |methods.
How |frequently |should |web |application |assessments |be |conducted? |- |CORRECT |ANSWER✔✔-
At |least |annually |and |after |any |significant |changes |(6.6)
Does |an |application |vulnerability |assessment |have |to |be |conducted |by |a |third |party? |- |
CORRECT |ANSWER✔✔-No. |As |long |as |the |reviewers |specialize |in |application |security |and |can |
demonstrate |independence |from |the |development |team.
What |is |NOT |included |in |cardholder |data?
-Primary |Account |Number |(PAN)
-PIN
-Cardholder |Name
-Expiration |Date
-CVV
-Service |Code |- |CORRECT |ANSWER✔✔-PIN |and |CVV |are |both |considered |sensitive |
authentication |data.
Which |of |the |following |CAN |BE |stored?
-Full |track |data
-PAN
-Cardholder |Name
-Service |Code
-PIN
-Expiration |Date
CORRECT ANSWERS
Which |of |the |following |does |not |belong?
The |following |events |should |be |included |in |automated |audit |trails |for |all |system |component:
-Individual |access |to |cardholder |data
-Creation |and |deletion |of |system-level |objects
-Invalid |logical |access |attempts
-Actions |taken |by |user |with |root |or |administrative |privileges
-Changes, |additions, |or |deletions |to |any |account |with |root |or |administrative |privileges
-Audit |trail |access
-Use |of |identification |and |authentication |mechanisms
-Elevation |of |privileges
-Initialization |of |audit |logs
-Stopping |or |pausing |of |audit |logs |- |CORRECT |ANSWER✔✔-All |of |these |should |be |included. |
(Requirement |10.2.1 |- |10.2.7)
Which |of |the |following |does |not |belong?
The |following |audit |trail |entries |should |be |recorded |for |each |event:
-User |identification
-Type |of |event
-Date |and |time
-Success |or |failure
-Origination |of |event
,-Identity |of |name |of |affected |data, |system |component, |or |resource
-Initializing, |stopping, |or |pausing |of |audit |logs |- |CORRECT |ANSWER✔✔-Initializing, |stopping, |or
|pausing |of |audit |logs |- |this |choice |is |part |of |what |should |be |included |in |audit |logs |(10.2)
This |question |pertains |to |10.3 |(10.3.1 |- |10.3.6)
How |often |should |logs |and |security |event |reviews |be |conducted? |- |CORRECT |ANSWER✔✔-At |
least |daily |(10.6)
How |long |should |audit |trail |history |be |retained?
At |least |___ |of |history |must |be |immediately |available |for |analysis. |- |CORRECT |ANSWER✔✔-At |
least |1 |year |retained
3 |months
(10.7)
How |long |should |visitor |logs |for |physical |access |be |retained? |- |CORRECT |ANSWER✔✔-At |least |
3 |months |(9.4)
Critical |patches |need |to |installed |within |___ |of |release. |- |CORRECT |ANSWER✔✔-One |month
For |public-facing |web |applications, |which |of |the |following |is |required?
-Web |application |firewalls
-Manual |vulnerability |assessment |tools
-Automated |vulnerability |assessment |tools |- |CORRECT |ANSWER✔✔-Any |one |or |more |of |these.
|According |to |Requirement |6.6, |ensure |that |either |one |of |the |following |methods |is |in |place:
, 1. |Web |application |firewalls |- |Examine |system |configuration |settings |to |verify |an |automated |
technical |solution |that |detects |and |prevents |web-based |attacks |is |in |place.
2. |Web |application |assessment |- |Verify |that |public-facing |web |applications |are |reviewed |using |
with |manual |or |automated |vulnerability |assessment |tools |or |methods.
How |frequently |should |web |application |assessments |be |conducted? |- |CORRECT |ANSWER✔✔-
At |least |annually |and |after |any |significant |changes |(6.6)
Does |an |application |vulnerability |assessment |have |to |be |conducted |by |a |third |party? |- |
CORRECT |ANSWER✔✔-No. |As |long |as |the |reviewers |specialize |in |application |security |and |can |
demonstrate |independence |from |the |development |team.
What |is |NOT |included |in |cardholder |data?
-Primary |Account |Number |(PAN)
-PIN
-Cardholder |Name
-Expiration |Date
-CVV
-Service |Code |- |CORRECT |ANSWER✔✔-PIN |and |CVV |are |both |considered |sensitive |
authentication |data.
Which |of |the |following |CAN |BE |stored?
-Full |track |data
-PAN
-Cardholder |Name
-Service |Code
-PIN
-Expiration |Date
