1 | Page
pci isa Questions and Correct Answers
QSAs must retain work papers for a minimum of _______ years. It
is a recommendation for ISAs to do the same. Ans: 3
According to PCI DSS requirement 1, Firewall and router rule sets
need to be reviewed every _____ months. Ans: 6
At least ______________ and prior to the annual assessment the
assessed entity:
- Identifies all locations and flows of cardholder data to verify they
are included in the CDE
- Confirms the accuracy of their PCI DSS scope
- Retains their scoping documentation for assessor reference Ans:
annually
scope includes Ans: ppl process, tech
Evidence Retention
It is recommended that the ISA secure and maintain digital and/or
hard copies of case logs, audit results and work papers, notes, and
any technical information that was created and/or obtained during
© 2025 All rights reserved
, 2 | Page
the PCI Data Security Assessment for a minimum of ________ or as
applicable to company data retention policies Ans: of three (3)
years
A (time) ______ process for identifying and securely deleting stored
cardholder data that exceeds defined retention requirements. Ans:
quarterly
Do not store SAD after ____________ (even if encrypted). (track data
/ cvc / pin) Ans: authorization
manual clear-text key-management procedures specify processes
for the use of the following Ans: Split knowledge.Dual control
Dual control Ans: least two people are required to perform any
key-management operations and no one person has access to the
authentication materials (for example, passwords or keys) of
another
Split knowledge Ans: key components are under the control of at
least two people who only have knowledge of their own key
components
PAN is rendered unreadable in which ways Ans: hash
mask
encrypt
© 2025 All rights reserved
pci isa Questions and Correct Answers
QSAs must retain work papers for a minimum of _______ years. It
is a recommendation for ISAs to do the same. Ans: 3
According to PCI DSS requirement 1, Firewall and router rule sets
need to be reviewed every _____ months. Ans: 6
At least ______________ and prior to the annual assessment the
assessed entity:
- Identifies all locations and flows of cardholder data to verify they
are included in the CDE
- Confirms the accuracy of their PCI DSS scope
- Retains their scoping documentation for assessor reference Ans:
annually
scope includes Ans: ppl process, tech
Evidence Retention
It is recommended that the ISA secure and maintain digital and/or
hard copies of case logs, audit results and work papers, notes, and
any technical information that was created and/or obtained during
© 2025 All rights reserved
, 2 | Page
the PCI Data Security Assessment for a minimum of ________ or as
applicable to company data retention policies Ans: of three (3)
years
A (time) ______ process for identifying and securely deleting stored
cardholder data that exceeds defined retention requirements. Ans:
quarterly
Do not store SAD after ____________ (even if encrypted). (track data
/ cvc / pin) Ans: authorization
manual clear-text key-management procedures specify processes
for the use of the following Ans: Split knowledge.Dual control
Dual control Ans: least two people are required to perform any
key-management operations and no one person has access to the
authentication materials (for example, passwords or keys) of
another
Split knowledge Ans: key components are under the control of at
least two people who only have knowledge of their own key
components
PAN is rendered unreadable in which ways Ans: hash
mask
encrypt
© 2025 All rights reserved
