PCI DSS 3.2.1 Exam with all Correct & 100% Verified
Answers |Actual Complete Exam |Already Graded A+
Which of the following does not belong?
The following events should be included in automated audit trails for all system component:
-Individual access to cardholder data
-Creation and deletion of system-level objects
-Invalid logical access attempts
-Actions taken by user with root or administrative privileges
-Changes, additions, or deletions to any account with root or administrative privileges
-Audit trail access
-Use of identification and authentication mechanisms
-Elevation of privileges
-Initialization of audit logs
-Stopping or pausing of audit logs ✔Correct Answer-All of these should be included. (Requirement
10.2.1 - 10.2.7)
Which of the following does not belong?
The following audit trail entries should be recorded for each event:
-User identification
-Type of event
-Date and time
-Success or failure
-Origination of event
-Identity of name of affected data, system component, or resource
-Initializing, stopping, or pausing of audit logs ✔Correct Answer-Initializing, stopping, or pausing of
audit logs - this choice is part of what should be included in audit logs (10.2)
This question pertains to 10.3 (10.3.1 - 10.3.6)
How often should logs and security event reviews be conducted? ✔Correct Answer-At least daily
(10.6)
How long should audit trail history be retained?
At least ___ of history must be immediately available for analysis. ✔Correct Answer-At least 1 year
retained
3 months
(10.7)
How long should visitor logs for physical access be retained? ✔Correct Answer-At least 3 months
(9.4)
Critical patches need to installed within ___ of release. ✔Correct Answer-One month
For public-facing web applications, which of the following is required?
-Web application firewalls
-Manual vulnerability assessment tools
, -Automated vulnerability assessment tools ✔Correct Answer-Any one or more of these. According
to Requirement 6.6, ensure that either one of the following methods is in place:
1. Web application firewalls - Examine system configuration settings to verify an automated technical
solution that detects and prevents web-based attacks is in place.
2. Web application assessment - Verify that public-facing web applications are reviewed using with
manual or automated vulnerability assessment tools or methods.
How frequently should web application assessments be conducted? ✔Correct Answer-At least
annually and after any significant changes (6.6)
Does an application vulnerability assessment have to be conducted by a third party? ✔Correct
Answer-No. As long as the reviewers specialize in application security and can demonstrate
independence from the development team.
What is NOT included in cardholder data?
-Primary Account Number (PAN)
-PIN
-Cardholder Name
-Expiration Date
-CVV
-Service Code ✔Correct Answer-PIN and CVV are both considered sensitive authentication data.
Which of the following CAN BE stored?
-Full track data
-PAN
-Cardholder Name
-Service Code
-PIN
-Expiration Date
-CVV ✔Correct Answer-PAN, cardholder name, service code, and expiration date can be stored
(requirement 3). However, storage should be limited to only required amount of time and purged
when no longer needed or at least quarterly. (3.1)
Sensitive authentication data cannot be stored after authorization (3.2).
Can full Track 1 data be stored? ✔Correct Answer-No. Track 1 data contains all fields of Track 2 data
plus the cardholder name and additional information for proprietary use by the issuer. It is generally
a violation to store anything to the right of the service code.
It is not permitted to store full track data or other sensitive authentication data after authorization.
Which SAQ applies to SERVICE PROVIDERS? ✔Correct Answer-SAQ D
Which SAQ applies to MERCHANTS that store any cardholder data, including legacy data?
✔Correct Answer-SAQ D
Which SAQ applies to MERCHANTS that accept transactions through a PCI-listed P2PE solution?
✔Correct Answer-SAQ P2PE
Answers |Actual Complete Exam |Already Graded A+
Which of the following does not belong?
The following events should be included in automated audit trails for all system component:
-Individual access to cardholder data
-Creation and deletion of system-level objects
-Invalid logical access attempts
-Actions taken by user with root or administrative privileges
-Changes, additions, or deletions to any account with root or administrative privileges
-Audit trail access
-Use of identification and authentication mechanisms
-Elevation of privileges
-Initialization of audit logs
-Stopping or pausing of audit logs ✔Correct Answer-All of these should be included. (Requirement
10.2.1 - 10.2.7)
Which of the following does not belong?
The following audit trail entries should be recorded for each event:
-User identification
-Type of event
-Date and time
-Success or failure
-Origination of event
-Identity of name of affected data, system component, or resource
-Initializing, stopping, or pausing of audit logs ✔Correct Answer-Initializing, stopping, or pausing of
audit logs - this choice is part of what should be included in audit logs (10.2)
This question pertains to 10.3 (10.3.1 - 10.3.6)
How often should logs and security event reviews be conducted? ✔Correct Answer-At least daily
(10.6)
How long should audit trail history be retained?
At least ___ of history must be immediately available for analysis. ✔Correct Answer-At least 1 year
retained
3 months
(10.7)
How long should visitor logs for physical access be retained? ✔Correct Answer-At least 3 months
(9.4)
Critical patches need to installed within ___ of release. ✔Correct Answer-One month
For public-facing web applications, which of the following is required?
-Web application firewalls
-Manual vulnerability assessment tools
, -Automated vulnerability assessment tools ✔Correct Answer-Any one or more of these. According
to Requirement 6.6, ensure that either one of the following methods is in place:
1. Web application firewalls - Examine system configuration settings to verify an automated technical
solution that detects and prevents web-based attacks is in place.
2. Web application assessment - Verify that public-facing web applications are reviewed using with
manual or automated vulnerability assessment tools or methods.
How frequently should web application assessments be conducted? ✔Correct Answer-At least
annually and after any significant changes (6.6)
Does an application vulnerability assessment have to be conducted by a third party? ✔Correct
Answer-No. As long as the reviewers specialize in application security and can demonstrate
independence from the development team.
What is NOT included in cardholder data?
-Primary Account Number (PAN)
-PIN
-Cardholder Name
-Expiration Date
-CVV
-Service Code ✔Correct Answer-PIN and CVV are both considered sensitive authentication data.
Which of the following CAN BE stored?
-Full track data
-PAN
-Cardholder Name
-Service Code
-PIN
-Expiration Date
-CVV ✔Correct Answer-PAN, cardholder name, service code, and expiration date can be stored
(requirement 3). However, storage should be limited to only required amount of time and purged
when no longer needed or at least quarterly. (3.1)
Sensitive authentication data cannot be stored after authorization (3.2).
Can full Track 1 data be stored? ✔Correct Answer-No. Track 1 data contains all fields of Track 2 data
plus the cardholder name and additional information for proprietary use by the issuer. It is generally
a violation to store anything to the right of the service code.
It is not permitted to store full track data or other sensitive authentication data after authorization.
Which SAQ applies to SERVICE PROVIDERS? ✔Correct Answer-SAQ D
Which SAQ applies to MERCHANTS that store any cardholder data, including legacy data?
✔Correct Answer-SAQ D
Which SAQ applies to MERCHANTS that accept transactions through a PCI-listed P2PE solution?
✔Correct Answer-SAQ P2PE
