P C I S E C U R I T Y S TA N D A R D S C O U N C I L · P C I P C E R T I F I C AT I O N
PCIP Professional
Certification
Complete Practice
Question Bank
Exam-Style Practice Questions with Rationales
Topic Focus: PCI DSS — Comprehensive Review
Edition 1 · July 2026
Table of Contents
1. Instructions for Use 2
2. Practice Questions with Answers & Rationales — PCIP Exam 2
PCI Security Standards Council · PCIP Certification Page 1
,PCIP CERTIFICATION PRACTICE GUIDE INSTRUCTIONS & PRACTICE QUESTIONS
How to Use This Guide
Read each stem, choose your answer, then check the rationale directly below it. The correct
option is marked, and each wrong option is explained so you understand why it's wrong — not
just that it is. These questions are designed to reflect the PCIP Professional Certification exam
style and content.
Category: PCIP — PCI DSS Professional Certification
1 The PCI Data Security Standard (PCI DSS) applies to:
A All entities that store, process, and/or transmit cardholder data
B Only merchants that process more than 1 million transactions per year
C Only service providers
D Only e-commerce merchants
Why A is correct: The PCI DSS applies to all entities that store, process, and/or transmit
cardholder data. It covers technical and operational system components included in or
connected to cardholder data. If you accept or process payment cards, PCI DSS applies to
you.
B — PCI DSS applies to all merchants regardless of transaction volume.
C — PCI DSS applies to both merchants and service providers.
D — PCI DSS applies to all channels, not just e-commerce.
, 2 Sensitive Authentication Data (SAD) includes which of the following?
A 3- or 4-digit security code (CVD), full track data from magnetic stripe or chip, and
PIN
B Cardholder name and PAN only
C Expiration date and service code only
D PAN and cardholder name
Why A is correct: Sensitive Authentication Data includes the 3- or 4-digit security code
printed on the front or back of a card (CVD), the data stored on a card's magnetic stripe or
chip (Full Track Data), and personal identification numbers (PIN) entered by the cardholder.
B — Cardholder name and PAN are cardholder data, not SAD.
C — Expiration date and service code are cardholder data, not SAD.
D — Cardholder name and PAN are cardholder data, not SAD.
3 Which of the following is the Visa code for Card Verification Data (CVD)?
A CVV2
B CVC2
C CID
D CAV2
Why A is correct: Visa uses CVV2 as its card verification code. MasterCard uses CVC2,
Discover uses CVD, JCB uses CAV2, and AmEx uses CID.
B — CVC2 is the MasterCard code.
C — CID is the AmEx code.
D — CAV2 is the JCB code.
PCIP Professional
Certification
Complete Practice
Question Bank
Exam-Style Practice Questions with Rationales
Topic Focus: PCI DSS — Comprehensive Review
Edition 1 · July 2026
Table of Contents
1. Instructions for Use 2
2. Practice Questions with Answers & Rationales — PCIP Exam 2
PCI Security Standards Council · PCIP Certification Page 1
,PCIP CERTIFICATION PRACTICE GUIDE INSTRUCTIONS & PRACTICE QUESTIONS
How to Use This Guide
Read each stem, choose your answer, then check the rationale directly below it. The correct
option is marked, and each wrong option is explained so you understand why it's wrong — not
just that it is. These questions are designed to reflect the PCIP Professional Certification exam
style and content.
Category: PCIP — PCI DSS Professional Certification
1 The PCI Data Security Standard (PCI DSS) applies to:
A All entities that store, process, and/or transmit cardholder data
B Only merchants that process more than 1 million transactions per year
C Only service providers
D Only e-commerce merchants
Why A is correct: The PCI DSS applies to all entities that store, process, and/or transmit
cardholder data. It covers technical and operational system components included in or
connected to cardholder data. If you accept or process payment cards, PCI DSS applies to
you.
B — PCI DSS applies to all merchants regardless of transaction volume.
C — PCI DSS applies to both merchants and service providers.
D — PCI DSS applies to all channels, not just e-commerce.
, 2 Sensitive Authentication Data (SAD) includes which of the following?
A 3- or 4-digit security code (CVD), full track data from magnetic stripe or chip, and
PIN
B Cardholder name and PAN only
C Expiration date and service code only
D PAN and cardholder name
Why A is correct: Sensitive Authentication Data includes the 3- or 4-digit security code
printed on the front or back of a card (CVD), the data stored on a card's magnetic stripe or
chip (Full Track Data), and personal identification numbers (PIN) entered by the cardholder.
B — Cardholder name and PAN are cardholder data, not SAD.
C — Expiration date and service code are cardholder data, not SAD.
D — Cardholder name and PAN are cardholder data, not SAD.
3 Which of the following is the Visa code for Card Verification Data (CVD)?
A CVV2
B CVC2
C CID
D CAV2
Why A is correct: Visa uses CVV2 as its card verification code. MasterCard uses CVC2,
Discover uses CVD, JCB uses CAV2, and AmEx uses CID.
B — CVC2 is the MasterCard code.
C — CID is the AmEx code.
D — CAV2 is the JCB code.
