PCI ISA Questions with Correct Answers
AAA
Acronym for "authentication, authorization, and accounting." Protocol for authenticating a
user based on their verifiable identity, authorizing a user based on their user rights, and
accounting for a user's consumption of network resources
Access Control
Mechanisms that limit availability of information or information-processing resources only to
authorized persons or applications
Account Data
consists of cardholder data and/or sensitive authentication data
Acquirer
Also referred to as "merchant bank," "acquiring bank," or "acquiring financial institution".
Entity, typically a financial institution, that processes payment card transactions for
merchants and is defined by a payment brand as an acquirer. Acquirers are subject to
payment brand rules and procedures regarding merchant compliance
Administrative Access
Elevated or increased privileges granted to an account in order for that account ot manage
systems, networks and/or applications.
Adware
Type of malicious software that, when installed, forces a computer to automatically display
or download advertisements
AES
, Abbreviation for "Advanced Encryption Standard." Block cipher used in symmetric
cryptography adopted by NIST in November 2001
ANSI
Acronym for "American National Standards Institute" Private, non-profit organization that
administers and coordinates the US voluntary standardization and conformity assessment
system
Anti-Virus
Program or software capable of detecting, removing, and protecting against various forms of
malicious software including viruses, worms, Trojans
AOC
Acronym for "attestation of compliance". The AOC is a form for merchants and service
providers to attest to the results of a PCI DSS assessment, as documented in the Self-
Assessment Questionnaire or Report on Compliance
AOV
Acronym for "attestation of validation". The AOV is a form for PA_QSAs to attest to the
results of a PA_DSS assessment, as documented in the PA-DSS Report on Validation.
Application
Includes all purchased and custom software programs or groups of programs, including both
internal and external applications.
ASV
Acronym for "approved Scanning Vendor". Company approved by the PCI SSC to conduct
external vulnerability scanning services.
AAA
Acronym for "authentication, authorization, and accounting." Protocol for authenticating a
user based on their verifiable identity, authorizing a user based on their user rights, and
accounting for a user's consumption of network resources
Access Control
Mechanisms that limit availability of information or information-processing resources only to
authorized persons or applications
Account Data
consists of cardholder data and/or sensitive authentication data
Acquirer
Also referred to as "merchant bank," "acquiring bank," or "acquiring financial institution".
Entity, typically a financial institution, that processes payment card transactions for
merchants and is defined by a payment brand as an acquirer. Acquirers are subject to
payment brand rules and procedures regarding merchant compliance
Administrative Access
Elevated or increased privileges granted to an account in order for that account ot manage
systems, networks and/or applications.
Adware
Type of malicious software that, when installed, forces a computer to automatically display
or download advertisements
AES
, Abbreviation for "Advanced Encryption Standard." Block cipher used in symmetric
cryptography adopted by NIST in November 2001
ANSI
Acronym for "American National Standards Institute" Private, non-profit organization that
administers and coordinates the US voluntary standardization and conformity assessment
system
Anti-Virus
Program or software capable of detecting, removing, and protecting against various forms of
malicious software including viruses, worms, Trojans
AOC
Acronym for "attestation of compliance". The AOC is a form for merchants and service
providers to attest to the results of a PCI DSS assessment, as documented in the Self-
Assessment Questionnaire or Report on Compliance
AOV
Acronym for "attestation of validation". The AOV is a form for PA_QSAs to attest to the
results of a PA_DSS assessment, as documented in the PA-DSS Report on Validation.
Application
Includes all purchased and custom software programs or groups of programs, including both
internal and external applications.
ASV
Acronym for "approved Scanning Vendor". Company approved by the PCI SSC to conduct
external vulnerability scanning services.
