PCI ISA EXAM (ACTUAL 2025/2026) QUESTIONS AND VERIFIED
CORRECT ANSWERS
When masking a card number what can be shown
first 6 and last 4
Acceptable methods for making PAN unreadable
Hash, Truncation, Tokenized, strong key cryptography
Secret/Private keys must be protected by what method(s)
1) key-encrypting key, stored separately. 2) Hardware Security
Module (HSM) 3) two full length key components (aka split
knowledge)
Spit Knowledge
two or more people separately have key components; knowing
only their half
List 3 or more open public networks
Internet, wireless networks (802.11 and Bluetooth), Cellular
networks, Satellite networks
, WEP
Wired Equivalent Privacy - 802.11 encryption. Very weak.
Retired in 2004. Use WPA2+AES instead
Anitvirus must be installed on what systems
Those commonly affected by malware
Systems considered not commonly affected by malware must
be reviewed ____________________
Periodically
CVSS
Common Vulnerability Scoring System; Open protocol for
scoring new vulnerabilities.
Critical security patches must be installed how soon after their
release
within one month
CORRECT ANSWERS
When masking a card number what can be shown
first 6 and last 4
Acceptable methods for making PAN unreadable
Hash, Truncation, Tokenized, strong key cryptography
Secret/Private keys must be protected by what method(s)
1) key-encrypting key, stored separately. 2) Hardware Security
Module (HSM) 3) two full length key components (aka split
knowledge)
Spit Knowledge
two or more people separately have key components; knowing
only their half
List 3 or more open public networks
Internet, wireless networks (802.11 and Bluetooth), Cellular
networks, Satellite networks
, WEP
Wired Equivalent Privacy - 802.11 encryption. Very weak.
Retired in 2004. Use WPA2+AES instead
Anitvirus must be installed on what systems
Those commonly affected by malware
Systems considered not commonly affected by malware must
be reviewed ____________________
Periodically
CVSS
Common Vulnerability Scoring System; Open protocol for
scoring new vulnerabilities.
Critical security patches must be installed how soon after their
release
within one month
