Enhance Your Career With Available Preparation Guide for Assessor_New_V4 Exam
Get Special Discount Offer of Assessor_New_V4 Certification Exam Sample Questions and Answers
NEW QUESTION # 29
An internal NTP server that provides lime services to the Cardholder Data Environment is?
- A. Only m scope if it stores processes or transmits cardholder data
- B. Only in scope if it provides time services to database servers.
- C. Not in scope for PCI DSS
- D. In scope for PCI DSS
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an internal NTP server that provides time services to the cardholder data environment is in scope for PCI DSS if it stores processes or transmits cardholder data, regardless of whether it provides authentication services to systems in the DMZ or not. This is one of the requirements for preventing unauthorized access to cardholder data using time services.
NEW QUESTION # 30
Which of the following types of events is required to be logged?
- A. All access to external web sites
- B. All use of end-user messaging technologies
- C. All access to all audit trails
- D. All network transmissions
Answer: C
Explanation:
Explanation
all network transmissions must be logged by an entity's security information and event management (SIEM) system or equivalent tool, which means they should record all network events and activities related to cardholder data processing and transmission. This is one of the requirements for ensuring that network transmissions are monitored and audited.
NEW QUESTION # 31
A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?
- A. Disable any firewall functions that are not needed in production
- B. Configure the firewall to permit all traffic until additional rules are defined
- C. Synchronize the firewall rules with the other firewalls m the environment
- D. Remove the default 'Firewall Administrator account and create a shared account for firewall administrators to use.
Answer: C
Explanation:
Explanation
According to requirement 3.1.2, a network firewall should be configured to permit only traffic that is necessary for its operation and security, which means it should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
NEW QUESTION # 32
Where can live PANs be used for testing?
- A. Pre-production (test) environments only if located outside the CDE.
- B. Testing with live PANs must only be performed in the QSA Company environment
- C. Pre-production environments that are located within the CDE
- D. Production (live) environments only
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, pre-production environments that are located within the cardholder data environment can be used for testing, as long as they are not accessible from untrusted networks and are monitored for any changes or vulnerabilities. This is one of the requirements for ensuring that testing environments are isolated from production environments.
NEW QUESTION # 33
Which of the following describes the intent of installing one primary function per server?
- A. To allow higher-security functions to protect lower-security functions installed on the same server
- B. To allow functions with different security levels to be implemented on the same server
- C. To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server - D. To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, installing one primary function per server is intended to prevent server functions with a lower security level from introducing security weaknesses to higher-security functions on the same server. This is one of the requirements for ensuring that server functions are isolated from each other.
NEW QUESTION # 34
PCI DSS Requirement 12.7 requires screening and background checks for which of the following?
- A. Personnel with access to the cardholder data environment.
- B. Visitors with access to the organization s facilities
- C. All personnel employed by the organization
- D. Cashiers with access to one card number at a time
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, screening and background checks for personnel with access to the cardholder data environment are required, as they may pose a risk if they have compromised or stolen cardholder data in the past or present. This is one of the requirements for ensuring that personnel with access to cardholder data are qualified and trustworthy.
NEW QUESTION # 35
Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?
- A. Security policy and procedure documents
- B. Application vendor manuals
- C. Files that regularly change
- D. System configuration and parameter files
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, system configuration and parameter files must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool). This is one of the requirements for ensuring that changes to system configuration and parameter files are detected and verified.
NEW QUESTION # 36
An entity wants to know if the Software Security Framework can be leveraged during their assessment Which of the following software types would this apply to?
- A. Any payment software in the CDE
- B. Only software which runs on PCI PTS devices
- C. Validated Payment Applications that are listed by PCI SSC and have undergone a PA-DSS assessment
- D. Software developed by the entity in accordance with the Secure SLC Standard
Answer: D
Explanation:
Explanation
According to requirement 12.3.2, software developed by an entity in accordance with the Secure SLC Standard must be validated by a Qualified Security Assessor (QSA) before it can be used by an entity in its CDE. This is one of the requirements for ensuring that software developed by an entity in accordance with the Secure SLC Standard meets all the security standards and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1.
NEW QUESTION # 37
Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?
- A. The retired key must not be used for encryption operations
- B. A new key custodian must be assigned
- C. Cryptographic key components from the retired key must be retained for 3 months before disposal
- D. All data encrypted under the retired key must be securely destroyed
Answer: D
Explanation:
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, all data encrypted under the retired key must be securely destroyed, which means it should be overwritten with random data or deleted from the storage device. This is one of the requirements for ensuring that data encryption keys are not reused or compromised.
NEW QUESTION # 38
Security policies and operational procedures should be?
- A. Encrypted with strong cryptography
- B. Stored securely so that only management has access
- C. Distributed to and understood by all affected parties
- D. Reviewed and updated at least quarterly
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, security policies and operational procedures should be distributed to and understood by all affected parties, such as management, staff, contractors, vendors, and service providers. This is one of the requirements for ensuring that security policies and operational procedures are communicated and followed consistently.
NEW QUESTION # 39
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)
- A. DES256
- B. ROT 13
- C. AES 128
- D. RSA512
Answer: A
Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the new key must have an appropriate strength for its intended use, which means it should have a sufficient length and complexity to resist brute-force attacks. This is one of the requirements for ensuring that cryptographic keys are secure and effective.
NEW QUESTION # 40
H an entity shares cardholder data with a TPSP, what activity is the entity required to perform'?
- A. The entity must perform a risk assessment of the TPSP's environment at least quarterly.
- B. The entity must conduct ASV scans on the TPSP's systems at least annually
- C. The entity must test the TPSP's incident response plan at least quarterly
- D. The entity must monitor the TPSP's PCI DSS compliance status at least annually
Answer: D
Explanation:
Explanation
According to requirement 4, an entity must monitor its TPSP's PCI DSS compliance status at least annually, which means it should review its TPSP's policies and procedures for protecting cardholder data and transactions against fraud and other threats at least once a year. This is one of the requirements for ensuring that an entity monitors its TPSP's PCI DSS compliance status regularly.
NEW QUESTION # 41
An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA During the assessment, you spend time completing the Controls Matrix and the TRA. while also ensuing that the customized control is implemented securely Which of the following statements is true?
- A. You can assess the customized control but another assessor must verify that you completed the TRA correctly
- B. You can assess the customized control and verify that the customized approach was correctly followed but you must document this in the ROC
- C. Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA
- D. You must document the work on the customized control in the ROC but you can not assess the control or the documentation
Answer: D
Explanation:
Explanation
According to requirement 1, assessing a customized control means verifying that it meets all the requirements and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1, which includes documenting and maintaining evidence about each customized control as defined in Appendix E. This is one of the requirements for ensuring that assessing a customized control is done correctly and consistently.
NEW QUESTION # 42
An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?
- A. Certificates are assigned only to administrative groups and not to regular users
- B. Change control processes are in place to ensue certificates are changed every 90 days
- C. Certificates are logged so they can be retrieved when the employee leaves the company
- D. A different certificate is assigned to each individual user account, and certificates are not shared
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a different certificate is assigned to each individual user account, and certificates are not shared. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
NEW QUESTION # 43
Which scenario meets PCI DSS requirements for restricting access to databases containing cardholder data?
- A. User access to the database is only through programmatic methods
- B. Direct queries to the database are restricted to shared database administrator accounts
- C. User access to the database is restricted to system and network administrators
- D. Application IDs for database applications can only be used by database administrators
Answer: D
Explanation:
Explanation
application IDs for database applications can only be used by database administrators, which means they should have access to all database applications and their settings. This is one of the requirements for ensuring that database administrators have full control over database applications.
NEW QUESTION # 44
In accordance with PCI DSS Requirement 10. how long must audit logs be retained?
- A. At least 3 months with the most recent month immediately available
- B. At least 2 years with the most recent month immediately available
- C. At least 2 years, with the most recent 3 months immediately available
- D. At least 1 year, with the most recent 3 months immediately available
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, audit logs must be retained for at least 1 year, with the most recent 3 months immediately available. This is one of the requirements for ensuring that audit logs are available for review and analysis.
NEW QUESTION # 45
Which statement is true regarding the PCI DSS Report on Compliance (ROC)?
- A. The assessor must create their own ROC template for each assessment report
- B. The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC
- C. The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.
- D. The ROC Reporting Template provided by PCI SSC is only required for service provider assessments
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor may use either their own template or the ROC Reporting Template provided by PCI SSC. This is one of the requirements for ensuring consistency and accuracy in ROCs.
NEW QUESTION # 46
At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?
- A. Clearing
- B. Settlement
- C. Authorization
- D. Chargeback
Answer: B
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, settlement occurs when a merchant receives payment from a card issuer for a completed transaction and delivers goods or services to a customer or another party as agreed upon in advance by both parties, subject to any conditions imposed by either party upon delivery or payment, including but not limited to acceptance, rejection, return, exchange, refund, cancellation, modification, suspension, termination or revocation by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment;
NEW QUESTION # 47
Which statement about PAN is true?
- A. It must be protected with strong cryptography (or transmission over private wired networks
- B. It does not require protection for transmission over public wireless networks
- C. It does not require protection for transmission over public wired networks
- D. It must be protected with strong cryptography for transmission over private wireless networks
Answer: D
Explanation:
Explanation
According to requirement 4, PAN must be protected with strong cryptography for transmission over private wireless networks, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception of cardholder data over wireless networks. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 48
Assigning a unique ID to each person is intended to ensure?
- A. Individual users are accountable for their own actions
- B. Access is assigned to group accounts based on need-to-know
- C. Strong passwords are used for each user account
- D. Shared accounts are only used by administrators
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, individual users are accountable for their own actions, which means they should use strong passwords, change them regularly, and not share them with anyone else. This is one of the requirements for ensuring that user accounts are properly managed and controlled.
NEW QUESTION # 49
......
Updated Assessor_New_V4 Dumps Questions Are Available For Passing PCI SSC Exam: https://dumpsstar.vce4plus.com/PCI-SSC/Assessor_New_V4-valid-vce-dumps.html