PCI DSS ISA Exam Review Questions with Answers Latest Complete 2023 (Already Graded A+)

PCI DSS ISA Exam Review Questions with Answers Latest Complete 2023 (Already Graded A+) What must be reviewed regarding unprotected PANs related to end-user messaging technologies? correct answerThat a written policy exists stating that unprotected PANs are not to be sent via end-user messaging technologies. What is considered in scope? correct answerSystem components that: - store, process, or transmit cardholder data - interact with cardholder data - have a connection to the CDE, - provide security services, facilitate segmentation Besides technologies, what else is considered in scope? correct answerPeople and Processes Examples of systems providing security services: correct answer- Authentication servers (LDAP) - Time management servers (NTP) - Patch deployment servers - Audit log servers and correlation servers - Anti-virus management servers - Routers and firewalls filtering network traffic - System performing cryptographic and/or key management functions - Systems controlling and/or monitoring physical access Examples of types of technologies correct answer- Servers, applications, networks, devices - Physical security systems - Logical security systems - Payment terminals and point of sale systems - Electronic communications - Backups and disaster recovery "hot" sites - Telecommunications - POTS vs. VOIP - Management systems - Remote access systems Sampling correct answerAn option for assessors to facilitate the assessment process. Is NOT used to implement PCI DSS requirements or to select requirements to be assessed. Principles of Sampling correct answer- Must be representative of the entire population - Business facilities and system components must be considered - System components must include all combinations - Must be large enough to provide assurance that controls are implemented as expected - Sampling methodology must be documented in ROC Pre-assessment planning includes: correct answerList of interviewees, system components, documentation, facilities. Familiarity with technologies included in assessment. If sampling, verify sample selection and size is representative of the entire population. Identification of the roles and the individuals within each role to be interviewed as part of the assessment. What are the six goals of the PCI Data Security Standard? correct answer1. Build and Maintain a Secure Network and Systems. 2. Protect Cardholder Data. 3. Maintain a Vulnerability Management Program. 4. Implement Strong Access Control Measures. 5. Regularly Monitor and Test Networks. 6. Maintain an Information Security Policy. What are the 12 PCI DSS Requirements? correct answer1. Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor-supplied defaults for system passwords and other security parameters. 3. Protect stored cardholder data.