Assessor_New_V4 Assessor_New_V4 Exam Questions and Answers

According to requirement 4, PAN must be protected with strong cryptography for transmission over private wireless networks, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception of cardholder data over wireless networks. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.

According to requirement 3.1.2, an assessment with at least one requirement marked as Not Tested is considered a partial assessment, which means it does not meet all the requirements and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1. This is one of the requirements for ensuring that assessments are conducted in accordance with PCI DSS.

when disk encryption is used to protect account data, access to the disk encryption must be managed independently of the operating system access control mechanisms, which means it should not be affected by changes in the operating system settings or permissions. This is one of the requirements for ensuring that disk encryption is secure and effective.

An LDAP server is a type of directory service that provides authentication and authorization data to the cardholder data environment (CDE)1. According to the PCI DSS scoping and segmentation guidance2, any system that provides a security service to the CDE, such as authentication, is considered a connected or security-impacting system (Category 2) and is in scope for PCI DSS. This is because such systems can affect the security and controls of the CDE and the cardholder data (CHD) or sensitive authentication data (SAD) that it contains. Therefore, an LDAP server providing authentication services to the CDE is in scope for PCI DSS, regardless of whether it stores, processes, or transmits CHD or SAD, or whether it provides authentication services to systems in the DMZ or not. References:

• Guidance for PCI DSS Scoping and Network Segmentation
• What Are the Effects of Using Active Directory as a Shared Service on PCI Compliance?
• The Ultimate Guide To PCI DSS Scoping and Segmentation
• LDAP - PCI Security Standards Council

According to requirement 1, network security controls are intended to control network traffic between two or more logical or physical network segments, which means they should prevent unauthorized access, modification, or disclosure of cardholder data or transactions over the network. This is one of the requirements for ensuring that network security controls are implemented and maintained in accordance with PCI DSS.

According to the PCI DSS v3.2.1 Quick Reference Guide1, passwords for default accounts and default administrative accounts should be changed before installing a system on the network. This is one of the requirements for preventing unauthorized access to cardholder data.

According to the PCI DSS v3.2.1 Quick Reference Guide1, internal vulnerability scans must be performed after a significant change in any component or configuration that affects cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.

According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor may use either their own template or the ROC Reporting Template provided by PCI SSC. This is one of the requirements for ensuring consistency and accuracy in ROCs.

 One of the best practices for hardening a firewall is to disable any firewall functions that are not needed in production, such as unused services, ports, protocols, or features. This reduces the attack surface and minimizes the potential for exploitation. According to the PCI Card Production Logical Security Requirements, section 3.2.1, “The firewall must be configured to deny all traffic by default and allow only traffic that is explicitly required for the card production environment.” Furthermore, section 3.2.2 states, “The firewall must be configured to block all unnecessary services, ports, protocols, and IP addresses.” References: PCI Card Production Logical Security Requirements, Card Production Security Assessor - Logical - Credly

The Secure SLC standard is one of the two standards that are part of the PCI Software Security Framework (SSF), which provides security requirements and assessment procedures for software vendors to integrate into their software development lifecycles and to validate that secure lifecycle management practices are in place12. The Secure SLC standard is designed to offer a more flexible approach to how the security and integrity of payment software is tested, and to address the evolving threat landscape and changes in software development practices3.

The PCI DSS Requirement 6 states that entities must develop and maintain secure systems and applications, and it includes several sub-requirements that cover variousaspects of software security, such as change control, secure coding, vulnerability management, and patching4. By using custom software that is compliant with the Secure SLC standard, an entity may be able to meet some or all of these sub-requirements, as the Secure SLC standard covers similar topics and ensures that the software is developed and maintained in a secure manner throughout its entire lifecycle1. However, this does not automatically make the entity PCI DSS compliant, as there are other requirements and controls that the entity must implement and validate, such as network security, access control, monitoring, and incident response4. Therefore, the correct answer is option B.

The other options are not true regarding the impact of using custom software that is compliant with the Secure SLC standard on the PCI DSS assessment. Option A is not true because, as explained above, the entity still has to comply with other PCI DSS requirements and controls that are not covered by the Secure SLC standard. Option C is not true because there is a positive impact to the entity, as it may help the entity to meet several requirements in Requirement 6 and to demonstrate that the custom software is secure and reliable. Option D is not true because the custom software cannot be excluded from the PCI DSS assessment, as it is part of the cardholder data environment (CDE) and it may store, process, or transmit cardholder data or sensitive authentication data. The entity must ensure that the custom software meets the PCI DSS requirements and controls that are applicable to it, and that the assessor validates its compliance4. References:

• Software Security Framework Secure Software Life Cycle (Secure SLC) Standard
• PCI Security Standards Council Publishes Version 1.1 of Secure Software Lifecycle (SLC) Standard and Program
• PCI Security Standards Council Publishes Version 1.1 of Secure Software Standard and Program
• PCI DSS v3.2.1

According to the PCI DSS v3.2.1 Quick Reference Guide1, audit logs must be retained for at least 1 year, with the most recent 3 months immediately available. This is one of the requirements for ensuring that audit logs are available for review and analysis.

According to the PCI DSS v3.2.1 Quick Reference Guide1, devices are periodically inspected to detect unauthorized card stammers using physical inspection or other methods such as software-based tools or network-based tools (such as firewalls). This is one of the requirements for preventing card skimming attacks that could compromise cardholder data.

According to the PCI DSS v3.2.1 Quick Reference Guide1, the security protocol accepts only trusted keys. This is one of the requirements for ensuring secure encryption and authentication.

According to the PCI DSS v3.2.1 Quick Reference Guide1, the database server should be relocated so that it is not accessible from untrusted networks. This is one of the requirements for protecting cardholder data in transit and at rest.

when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity’s systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.