PCIP Practice Questions & Answers

When a Service Provider has been defined by a payment brand as eligible to complete a SAQ, which SAQ is used? Imprint-Only Merchants with no electronic storage of cardholder data would use which SAQ? A. SAQ C/VT B. SAQ B C. SAQ A A. SAQ D B. SAQ B C. SAQ A D. SAQ C - ANSWER Correct Answer: A Information Supplements provided by the PCI SSC may "supersede" requirements. A. True B. False - ANSWER Correct Answer: B If virtualization technologies are used in a cardholder data environment, PCI DSS requirements apply to those virtualization technologies. A. False B. True - ANSWER Correct Answer: B The presumption of P2PE is that cardholder data in transit is protected when it is encrypted to the extent that an entity in possession of the ciphertext alone can easily reverse the encryption process A. False B. True - ANSWER Correct Answer: A Encrypting account data at the point of capture is one way an entity involved in payment card processing via mobile devices can actively help in controlling risks to the security of cardholder data. A. True B. False - ANSWER Correct Answer: A In order to be considered a compensating control, which of the following must exist? A. A legitimate technical constraint and a documented business constraint. B. A legitimate technical constraint. C. A legitimate technical constraint of a documented business constraint. D. A documented business constraint. - ANSWER Correct Answer: C PCI DSS Requirement 1 A. Install and maintain a firewall configuration to protect cardholder data B. Do not use vendor supplied defaults for system passwords and other security parameters C. Protect stored cardholder data by enacting a formal data retention policy and implement secure deletion methods D. Protected Cardholder Data during transmission over the internet, wireless networks or other open access networks or systems (GSM, GPRS, etc.) - ANSWER Correct Answer: A