PCI ISA: Internal Security Assessor
Certification Exam Review
75 Practice Questions with Correct Answers and Rationales | 2026/2027 Edition
PCI Security Standards Council Professional Certification Preparation
, PCI ISA Certification Exam Review | 2026/2027
Domain 1: PCI DSS Requirements 1–3: Network Security & Data
Protection (Questions 1–15)
Question 1:
According to PCI DSS v4.0 Requirement 1, which of the following is the PRIMARY purpose of
maintaining a formal firewall configuration standard?
A) To ensure firewalls are branded by a PCI SSC-approved vendor
B) To establish a baseline for securing network perimeters and controlling traffic between
trusted and untrusted networks
C) To eliminate the need for network segmentation validation
D) To replace the need for intrusion detection systems
Correct Answer: B) To establish a baseline for securing network perimeters and controlling
traffic between trusted and untrusted networks
Rationale: PCI DSS v4.0 Requirement 1.1 mandates that organizations install and maintain
network security controls connected to cardholder data, supported by a formal configuration
standard. This standard establishes the foundational rules for firewall rule sets, default deny
policies, and connection restrictions between untrusted networks and the Cardholder Data
Environment (CDE). Options A, C, and D are incorrect because PCI DSS does not prescribe
specific vendors, segmentation validation remains independently required, and firewalls
complement rather than replace IDS.
Question 2:
An ISA is reviewing a merchant's router configuration and discovers that the router permits all
inbound traffic on port 443 without restriction. Which PCI DSS v4.0 requirement is most directly
violated?
A) Requirement 1.2 – Restrict connections between untrusted networks and cardholder data via
firewall and router restrictions
B) Requirement 3.5 – Protect cryptographic keys used for cardholder data encryption
C) Requirement 6.3 – Develop and maintain secure systems and applications
D) Requirement 10.1 – Implement audit logging for all system components
Correct Answer: A) Requirement 1.2 – Restrict connections between untrusted networks and
cardholder data via firewall and router restrictions
Rationale: Requirement 1.2.1 requires that inbound traffic from untrusted networks be
restricted to only those connections required for business purposes. Allowing all inbound
traffic on port 443 without restriction violates this principle by not limiting traffic to
1
, PCI ISA Certification Exam Review | 2026/2027
specifically authorized sources. Requirement 1.3 further mandates a default-deny rule. While
other requirements are important, this finding directly maps to network perimeter control
requirements.
Question 3:
Which of the following best describes a properly implemented DMZ architecture in the context of
PCI DSS compliance?
A) All cardholder data is stored directly in the DMZ to maximize accessibility for payment
processing
B) The DMZ acts as an intermediate network zone with its own firewall controls, separating
public-facing systems from the internal CDE
C) The DMZ replaces the need for internal network segmentation between the CDE and non-
CDE systems
D) Systems in the DMZ are exempt from PCI DSS requirements because they are not internal
Correct Answer: B) The DMZ acts as an intermediate network zone with its own firewall
controls, separating public-facing systems from the internal CDE
Rationale: A DMZ (Demilitarized Zone) is a buffer network segment that sits between the
external internet and the internal network, hosting public-facing systems like web servers. PCI
DSS Requirement 1.3.1 requires restricting inbound internet traffic to only DMZ systems, and
Requirement 1.3.2 requires restricting traffic from the DMZ to the internal network.
Cardholder data should not be stored in the DMZ (A is wrong), the DMZ does not replace
internal segmentation (C is wrong), and DMZ systems that are part of or connected to the CDE
are in scope (D is wrong).
Question 4:
Under PCI DSS v4.0, which method is considered the most reliable for validating that network
segmentation is effective at isolating the CDE?
A) Reviewing the network diagram to confirm segmentation is documented
B) Performing a penetration test that specifically tests segmentation controls
C) Verifying that VLANs are configured on network switches
D) Confirming that the merchant has a firewall between the CDE and corporate network
Correct Answer: B) Performing a penetration test that specifically tests segmentation controls
Rationale: PCI DSS v4.0 Requirement 1.3.5 requires that segmentation be verified using a
penetration testing methodology. While network diagrams (A), VLAN configurations (C), and
firewall placement (D) are all important supporting elements, only active penetration testing
provides empirical validation that segmentation controls actually prevent unauthorized access
2
Certification Exam Review
75 Practice Questions with Correct Answers and Rationales | 2026/2027 Edition
PCI Security Standards Council Professional Certification Preparation
, PCI ISA Certification Exam Review | 2026/2027
Domain 1: PCI DSS Requirements 1–3: Network Security & Data
Protection (Questions 1–15)
Question 1:
According to PCI DSS v4.0 Requirement 1, which of the following is the PRIMARY purpose of
maintaining a formal firewall configuration standard?
A) To ensure firewalls are branded by a PCI SSC-approved vendor
B) To establish a baseline for securing network perimeters and controlling traffic between
trusted and untrusted networks
C) To eliminate the need for network segmentation validation
D) To replace the need for intrusion detection systems
Correct Answer: B) To establish a baseline for securing network perimeters and controlling
traffic between trusted and untrusted networks
Rationale: PCI DSS v4.0 Requirement 1.1 mandates that organizations install and maintain
network security controls connected to cardholder data, supported by a formal configuration
standard. This standard establishes the foundational rules for firewall rule sets, default deny
policies, and connection restrictions between untrusted networks and the Cardholder Data
Environment (CDE). Options A, C, and D are incorrect because PCI DSS does not prescribe
specific vendors, segmentation validation remains independently required, and firewalls
complement rather than replace IDS.
Question 2:
An ISA is reviewing a merchant's router configuration and discovers that the router permits all
inbound traffic on port 443 without restriction. Which PCI DSS v4.0 requirement is most directly
violated?
A) Requirement 1.2 – Restrict connections between untrusted networks and cardholder data via
firewall and router restrictions
B) Requirement 3.5 – Protect cryptographic keys used for cardholder data encryption
C) Requirement 6.3 – Develop and maintain secure systems and applications
D) Requirement 10.1 – Implement audit logging for all system components
Correct Answer: A) Requirement 1.2 – Restrict connections between untrusted networks and
cardholder data via firewall and router restrictions
Rationale: Requirement 1.2.1 requires that inbound traffic from untrusted networks be
restricted to only those connections required for business purposes. Allowing all inbound
traffic on port 443 without restriction violates this principle by not limiting traffic to
1
, PCI ISA Certification Exam Review | 2026/2027
specifically authorized sources. Requirement 1.3 further mandates a default-deny rule. While
other requirements are important, this finding directly maps to network perimeter control
requirements.
Question 3:
Which of the following best describes a properly implemented DMZ architecture in the context of
PCI DSS compliance?
A) All cardholder data is stored directly in the DMZ to maximize accessibility for payment
processing
B) The DMZ acts as an intermediate network zone with its own firewall controls, separating
public-facing systems from the internal CDE
C) The DMZ replaces the need for internal network segmentation between the CDE and non-
CDE systems
D) Systems in the DMZ are exempt from PCI DSS requirements because they are not internal
Correct Answer: B) The DMZ acts as an intermediate network zone with its own firewall
controls, separating public-facing systems from the internal CDE
Rationale: A DMZ (Demilitarized Zone) is a buffer network segment that sits between the
external internet and the internal network, hosting public-facing systems like web servers. PCI
DSS Requirement 1.3.1 requires restricting inbound internet traffic to only DMZ systems, and
Requirement 1.3.2 requires restricting traffic from the DMZ to the internal network.
Cardholder data should not be stored in the DMZ (A is wrong), the DMZ does not replace
internal segmentation (C is wrong), and DMZ systems that are part of or connected to the CDE
are in scope (D is wrong).
Question 4:
Under PCI DSS v4.0, which method is considered the most reliable for validating that network
segmentation is effective at isolating the CDE?
A) Reviewing the network diagram to confirm segmentation is documented
B) Performing a penetration test that specifically tests segmentation controls
C) Verifying that VLANs are configured on network switches
D) Confirming that the merchant has a firewall between the CDE and corporate network
Correct Answer: B) Performing a penetration test that specifically tests segmentation controls
Rationale: PCI DSS v4.0 Requirement 1.3.5 requires that segmentation be verified using a
penetration testing methodology. While network diagrams (A), VLAN configurations (C), and
firewall placement (D) are all important supporting elements, only active penetration testing
provides empirical validation that segmentation controls actually prevent unauthorized access
2
