PCI ISA Exam 1 Study Guide: 75 Realistic Case-Based
Questions with Answers with well detailed rationales
GRADED A+
Case Study 1: The Legacy System Conundrum
Scenario: You are the ISA for a regional retailer, "RetailX." RetailX processes credit cards at
Point-of-Sale (POS) terminals in 50 stores. The POS systems run on Windows 7 (end-of-life) and
are managed by a third-party vendor, "POSCo." POSCo has remote access to the systems for
troubleshooting. The CDE is segmented from the corporate network. During a site visit, you
find a store manager has connected a personal laptop to the POS network switch to play
music.
1. A store manager connected a personal laptop to the POS network switch. What is the
PRIMARY violation?
A) Requirement 9: Physical Security
B) Requirement 1: Firewall Configuration
C) Requirement 12: Information Security Policy
D) Requirement 10: Logging and Monitoring
Rationale: C is correct. While this touches on physical security (Req 9) and network
segmentation (Req 1), the primary violation is the failure of the information security
policy (Req 12.6) to educate employees, and the failure to maintain operational
procedures (Req 12.1) that prohibit unauthorized devices on the CDE network. The ISA must
look at the root cause—policy and awareness failure.
2. Regarding the Windows 7 POS systems, which requirement is most directly at risk?
A) Requirement 5: Anti-virus
B) Requirement 6: Secure Systems and Applications
C) Requirement 3: Protect Stored Cardholder Data
D) Requirement 8: Strong Access Control
Rationale: B is correct. Windows 7 is end-of-life (EOL). Requirement 6.2 mandates that all
system components are protected from known vulnerabilities by installing applicable vendor-
supplied security patches within 1 month of release. Since Microsoft no longer releases
patches for Windows 7, the systems are non-compliant with 6.2. Requirement 5 (Anti-virus) is
still necessary, but the critical risk is the lack of security patches.
,3. POSCo has remote access for troubleshooting. What must RetailX ensure regarding this
access?
A) POSCo must use a shared generic account to simplify auditing.
B) Remote access must be enabled 24/7 for emergency support.
C) Multi-factor authentication (MFA) is required for all remote access originating from outside
the CDE.
D) POSCo’s access does not need to be logged if they are a TPSP.
Rationale: C is correct. Requirement 8.3.1 (and 8.3.2) mandates MFA for all remote access
(non-console) originating from outside the entity’s network. Even if POSCo is a Third-Party
Service Provider (TPSP), the merchant (RetailX) is responsible for ensuring the security of that
access path.
4. If RetailX claims the corporate network is out-of-scope due to segmentation, what
validation is required?
A) A network diagram showing the firewall separating the networks.
B) A penetration test of the segmentation controls at least annually and after any changes.
C) An attestation from the CEO that the networks are separate.
D) A physical lock on the server room door.
Rationale: B is correct. Requirement 11.3.4 (or 11.3.1 in older versions) specifically requires
segmentation testing to verify that out-of-scope systems cannot access in-scope systems. A
diagram (A) is required, but validation requires testing.
5. A store’s POS system crashes. POSCo logs in remotely using a vendor account. What is the
logging requirement?
A) Only failed logins need to be logged.
B) User identity, date/time, success/failure, and source IP must be logged.
C) Logs are optional if the session is recorded on video.
D) Only root-level commands need to be logged.
Rationale: B is correct. Requirement 10.2.2 mandates logging of all individual user access to
cardholder data. This includes the user ID, date/time, success/failure, and the originating IP
address. Shared generic accounts (A) are prohibited because they prevent accountability.
Case Study 2: The E-commerce SaaS Overlap
Scenario: "WebStyle," a clothing brand, uses a SaaS e-commerce platform (ShopFast) to host
its website. ShopFast handles the checkout page (iFrame). WebStyle employees access a
virtual terminal on ShopFast’s portal to process phone orders. WebStyle also uses a marketing
agency, "AdGuru," which has access to the content management system (CMS) of the website
but not the checkout.
6. Regarding the SaaS e-commerce platform (ShopFast), what is WebStyle’s responsibility?
A) WebStyle is fully out of scope because ShopFast is a TPSP.
B) WebStyle must ensure ShopFast provides a current Attestation of Compliance (AOC) and
ensure their own integration is secure.
C) WebStyle must perform a physical audit of ShopFast’s data center.
D) WebStyle must install patches on ShopFast’s servers.
Rationale: B is correct. When using a TPSP (like a SaaS platform), the merchant’s responsibility
is to manage the relationship. Requirement 12.8 requires maintaining a list of TPSPs,
confirming their PCI compliance status (AOC), and ensuring responsibilities are documented.
The merchant does not audit the TPSP’s infrastructure (C) but must verify compliance.
, 7. The checkout page uses an iFrame hosted by ShopFast. How does this affect WebStyle’s
scope?
A) WebStyle’s entire website becomes in-scope.
B) The iFrame is considered a third-party script; WebStyle must have a process to monitor the
script’s integrity to prevent skimming (e.g., formjacking).
C) WebStyle does not need to worry about the iFrame because it is encrypted.
D) WebStyle must perform a source code review of ShopFast’s iFrame code.
Rationale: B is correct. This addresses "e-skimming" or formjacking. Requirement 6.4.3 (and
11.6.1 in v4.0) requires a mechanism to detect unauthorized changes to HTTP headers and the
content of payment pages. While the iFrame shifts scope for the transmission, the merchant is
still responsible for the security of the page surrounding the iFrame and ensuring the script
loaded is legitimate.
8. The marketing agency (AdGuru) has CMS access to change product descriptions. What is
the security concern?
A) AdGuru’s access must be treated as if they have access to the CDE because they can deface
the site.
B) The CMS must be segmented from the CDE, and AdGuru’s access must use MFA if it crosses
a network boundary.
C) AdGuru must be a Level 1 TPSP.
D) AdGuru cannot have access if they are not PCI compliant.
Rationale: B is correct. If the CMS does not store, process, or transmit cardholder data, it can
be out-of-scope. However, if the marketing agency logs into the CMS from the internet, and
that CMS resides on the same network segment as the CDE (or can be used to pivot), it is a risk.
Segmentation and MFA (Req 8.3.1) are required to isolate this access.
9. Employees use a virtual terminal on ShopFast’s portal. What is the requirement for the
workstations used to access this portal?
A) The workstations are out of scope because the portal is cloud-based.
B) The workstations are in-scope as "administrative access points" into the CDE and must be
hardened per PCI DSS requirements.
C) Only the browser used needs to be updated; the OS is irrelevant.
D) The workstations must use dedicated token hardware.
Rationale: B is correct. Any workstation used to access the CDE (including a virtual terminal) is
a system component (see glossary). It is considered "in-scope" because it interacts with the
CDE. It must meet requirements for malware protection (Req 5), secure configuration (Req 2),
and access control (Req 8).
10. WebStyle wants to store customer email addresses and purchase amounts for marketing,
but not the full PAN. Is this in scope?
A) Yes, because the email address is linked to a purchase amount and could be used to
reconstruct data.
B) No, because the PAN is not stored.
C) Only if the email address is stored in the same database as the truncated PAN.
D) No, because marketing systems are always out of scope.
Rationale: A is correct. Scope is defined by systems that store, process, or transmit cardholder
data or systems that affect the security of the CDE. If the marketing database stores SAD or
PAN, it’s clearly in-scope. However, if it stores data that is connected to or controls the CDE, it
is also in-scope. While storing just email and amount is not storing PAN, if that system
connects to the CDE to retrieve that data, it becomes in-scope. The safest interpretation under
Questions with Answers with well detailed rationales
GRADED A+
Case Study 1: The Legacy System Conundrum
Scenario: You are the ISA for a regional retailer, "RetailX." RetailX processes credit cards at
Point-of-Sale (POS) terminals in 50 stores. The POS systems run on Windows 7 (end-of-life) and
are managed by a third-party vendor, "POSCo." POSCo has remote access to the systems for
troubleshooting. The CDE is segmented from the corporate network. During a site visit, you
find a store manager has connected a personal laptop to the POS network switch to play
music.
1. A store manager connected a personal laptop to the POS network switch. What is the
PRIMARY violation?
A) Requirement 9: Physical Security
B) Requirement 1: Firewall Configuration
C) Requirement 12: Information Security Policy
D) Requirement 10: Logging and Monitoring
Rationale: C is correct. While this touches on physical security (Req 9) and network
segmentation (Req 1), the primary violation is the failure of the information security
policy (Req 12.6) to educate employees, and the failure to maintain operational
procedures (Req 12.1) that prohibit unauthorized devices on the CDE network. The ISA must
look at the root cause—policy and awareness failure.
2. Regarding the Windows 7 POS systems, which requirement is most directly at risk?
A) Requirement 5: Anti-virus
B) Requirement 6: Secure Systems and Applications
C) Requirement 3: Protect Stored Cardholder Data
D) Requirement 8: Strong Access Control
Rationale: B is correct. Windows 7 is end-of-life (EOL). Requirement 6.2 mandates that all
system components are protected from known vulnerabilities by installing applicable vendor-
supplied security patches within 1 month of release. Since Microsoft no longer releases
patches for Windows 7, the systems are non-compliant with 6.2. Requirement 5 (Anti-virus) is
still necessary, but the critical risk is the lack of security patches.
,3. POSCo has remote access for troubleshooting. What must RetailX ensure regarding this
access?
A) POSCo must use a shared generic account to simplify auditing.
B) Remote access must be enabled 24/7 for emergency support.
C) Multi-factor authentication (MFA) is required for all remote access originating from outside
the CDE.
D) POSCo’s access does not need to be logged if they are a TPSP.
Rationale: C is correct. Requirement 8.3.1 (and 8.3.2) mandates MFA for all remote access
(non-console) originating from outside the entity’s network. Even if POSCo is a Third-Party
Service Provider (TPSP), the merchant (RetailX) is responsible for ensuring the security of that
access path.
4. If RetailX claims the corporate network is out-of-scope due to segmentation, what
validation is required?
A) A network diagram showing the firewall separating the networks.
B) A penetration test of the segmentation controls at least annually and after any changes.
C) An attestation from the CEO that the networks are separate.
D) A physical lock on the server room door.
Rationale: B is correct. Requirement 11.3.4 (or 11.3.1 in older versions) specifically requires
segmentation testing to verify that out-of-scope systems cannot access in-scope systems. A
diagram (A) is required, but validation requires testing.
5. A store’s POS system crashes. POSCo logs in remotely using a vendor account. What is the
logging requirement?
A) Only failed logins need to be logged.
B) User identity, date/time, success/failure, and source IP must be logged.
C) Logs are optional if the session is recorded on video.
D) Only root-level commands need to be logged.
Rationale: B is correct. Requirement 10.2.2 mandates logging of all individual user access to
cardholder data. This includes the user ID, date/time, success/failure, and the originating IP
address. Shared generic accounts (A) are prohibited because they prevent accountability.
Case Study 2: The E-commerce SaaS Overlap
Scenario: "WebStyle," a clothing brand, uses a SaaS e-commerce platform (ShopFast) to host
its website. ShopFast handles the checkout page (iFrame). WebStyle employees access a
virtual terminal on ShopFast’s portal to process phone orders. WebStyle also uses a marketing
agency, "AdGuru," which has access to the content management system (CMS) of the website
but not the checkout.
6. Regarding the SaaS e-commerce platform (ShopFast), what is WebStyle’s responsibility?
A) WebStyle is fully out of scope because ShopFast is a TPSP.
B) WebStyle must ensure ShopFast provides a current Attestation of Compliance (AOC) and
ensure their own integration is secure.
C) WebStyle must perform a physical audit of ShopFast’s data center.
D) WebStyle must install patches on ShopFast’s servers.
Rationale: B is correct. When using a TPSP (like a SaaS platform), the merchant’s responsibility
is to manage the relationship. Requirement 12.8 requires maintaining a list of TPSPs,
confirming their PCI compliance status (AOC), and ensuring responsibilities are documented.
The merchant does not audit the TPSP’s infrastructure (C) but must verify compliance.
, 7. The checkout page uses an iFrame hosted by ShopFast. How does this affect WebStyle’s
scope?
A) WebStyle’s entire website becomes in-scope.
B) The iFrame is considered a third-party script; WebStyle must have a process to monitor the
script’s integrity to prevent skimming (e.g., formjacking).
C) WebStyle does not need to worry about the iFrame because it is encrypted.
D) WebStyle must perform a source code review of ShopFast’s iFrame code.
Rationale: B is correct. This addresses "e-skimming" or formjacking. Requirement 6.4.3 (and
11.6.1 in v4.0) requires a mechanism to detect unauthorized changes to HTTP headers and the
content of payment pages. While the iFrame shifts scope for the transmission, the merchant is
still responsible for the security of the page surrounding the iFrame and ensuring the script
loaded is legitimate.
8. The marketing agency (AdGuru) has CMS access to change product descriptions. What is
the security concern?
A) AdGuru’s access must be treated as if they have access to the CDE because they can deface
the site.
B) The CMS must be segmented from the CDE, and AdGuru’s access must use MFA if it crosses
a network boundary.
C) AdGuru must be a Level 1 TPSP.
D) AdGuru cannot have access if they are not PCI compliant.
Rationale: B is correct. If the CMS does not store, process, or transmit cardholder data, it can
be out-of-scope. However, if the marketing agency logs into the CMS from the internet, and
that CMS resides on the same network segment as the CDE (or can be used to pivot), it is a risk.
Segmentation and MFA (Req 8.3.1) are required to isolate this access.
9. Employees use a virtual terminal on ShopFast’s portal. What is the requirement for the
workstations used to access this portal?
A) The workstations are out of scope because the portal is cloud-based.
B) The workstations are in-scope as "administrative access points" into the CDE and must be
hardened per PCI DSS requirements.
C) Only the browser used needs to be updated; the OS is irrelevant.
D) The workstations must use dedicated token hardware.
Rationale: B is correct. Any workstation used to access the CDE (including a virtual terminal) is
a system component (see glossary). It is considered "in-scope" because it interacts with the
CDE. It must meet requirements for malware protection (Req 5), secure configuration (Req 2),
and access control (Req 8).
10. WebStyle wants to store customer email addresses and purchase amounts for marketing,
but not the full PAN. Is this in scope?
A) Yes, because the email address is linked to a purchase amount and could be used to
reconstruct data.
B) No, because the PAN is not stored.
C) Only if the email address is stored in the same database as the truncated PAN.
D) No, because marketing systems are always out of scope.
Rationale: A is correct. Scope is defined by systems that store, process, or transmit cardholder
data or systems that affect the security of the CDE. If the marketing database stores SAD or
PAN, it’s clearly in-scope. However, if it stores data that is connected to or controls the CDE, it
is also in-scope. While storing just email and amount is not storing PAN, if that system
connects to the CDE to retrieve that data, it becomes in-scope. The safest interpretation under
