QIR Practice Exam Questions And Answers 2022

PCI Stands for? Payment Card Industry CDE stands for... Cardholder Data Environment PCI-SSC stands for? Payment Card Industry-Security Standards Council DSS Stands for? Data Security Standard PCI DSS covers... 12 points that Merchants and Service Providers must comply with the be PCI Certified. PA-DSS stands for? Payment Application-Data Security Standard PA-DSS certification denotes that... the payment application can be configured to meet PCI DSS requirements. PA-DSS covers... Secure payment applications to support PCI DSS compliance. Payment application receives account data from PIN-entry devices (PEDs) or other devices and begins payment transaction PA-DSS applies to application that perform ____________________ and/or ___________________. authorization settlement PA-DSS has ___________ requirements 14 PCI-DSS has ______________ requirements and ____________ goals 12 6 True or False - PA-DSS supports PCI-DSS True in many requirements but not all apply True or False - PCI-DSS does not require all transmission of cardholder data be encrypted over open, public networks. False It is encryption IS required over public networks according to PCI-DSS requirement 4. True or False - Default passwords are sometimes allowed under certain circumstances with proper documentation. False Default passwords are NEVER allowed in a Qualified Implementation Video logs must be kept ___________ days. 90 True or False - Media does not mean paper False Media can mean paper or electronic media Audit logs must be kept for ____________ 1 year True or False - QIRs are also required to provide troubleshooting for the Payment application False QIRs may perform troubleshooting and remote support after the installation but it is not required. The LEAD QIR is responsible for these 4 things... (1) Document all tasks that both the customer and QIR perform (2) Confirm the responsibilities of the QIR during and after the Implementation (3) Accept accountability for all tasks (4) Sign the Implementation Statement True or False - "Acceptable only for pre-existing Deployments" status for a Payment Application means a Qualified Implementation cannot be performed. True Only "Acceptable for New Deployments" status are eligible In preparation for a Qualified Installation, you should provide a customer with what 3 pieces of information? (1) Name of Lead QIR (2) Estimate of the work to be performed (cost, duration, downtime) (3) a link to the QIR feedback form The PA-DSS Implementation Guide is provided by _____________ The Payment Application Vendor The QIR Implementation Statement is provided by ____________ the PCI Council True or False - Questions about the PA-DSS Implementation Guide must go to the PCI Council. False Questions on the PA-DSS Implementation Guide go to the application vendor Name the 3 sections of the Implementation Statement. (1) Summary (2) Details (3) QIR additional Observations True or False - The Lead QIR must review the results with the Customer. True How long must the QIR keep all paperwork of a Qualified Installation? 3 Years How long does the QIR have to deliver the Implementation Statement to the Customer following a Qualified Installation? 10 business days True or False - It is the responsibility of the QIR to collect training materials on the Payment Application to be installed. True True or False - A Merchant may hire a QSA to perform a Qualified Installation. False Only a QIR can perform a Qualified Installation True or False - For a QIR maintaining a payment application, critical security patches must be applied within 7 business days. False Critical patches must be implemented within 30 days. When is it acceptable to collect sensitive authentication data? When debugging or troubleshooting True or False - A QIR must wait until the Implementation Statement is complete before reporting evidence of a potential vulnerability or breach. False Evidence of a breach must be reported imediately True or False - A Qualified Installation guarantees PCI Compliance. False but it is a good first step True or False - it is the Lead QIRs role to notify the Customer of the QIR Feedback form on the PCI website. False It is only a requirement that the customer be notified. The Lead QIR does not have to be the person to do it.