Real Assessor_New_V4 dumps Accurate Questions and Answers with Free and Fast Updates [Q10-Q33]

QUESTION 10
Passwords for default accounts and default administrative accounts should be?

Changed within 30 days after installing a system on the network.

Reset to the default password before installing a system on the network

Changed before installing a system on the network

Configured to expire in 30 days

QUESTION 11
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)

DES256

RSA512

AES 128

ROT 13

QUESTION 12
An entity is using custom software in their CDE.The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard.What impact will this have on the entity’s PCI DSS assessment?

It automatically makes an entity PCI DSS compliant

It may help the entity to meet several requirements in Requirement 6.

There is no impact to the entity

The custom software can be excluded from the PCI DSS assessment

QUESTION 13
In accordance with PCI DSS Requirement 10. how long must audit logs be retained?

At least 1 year, with the most recent 3 months immediately available

At least 2 years, with the most recent 3 months immediately available

At least 2 years with the most recent month immediately available

At least 3 months with the most recent month immediately available

QUESTION 14
What must be included m an organization’s procedures for managing visitors9

Visitor log includes visitor name, address, and contact phone number

Visitor badges are identical to badges used by onsite personnel

Visitors are escorted at all times within areas where cardholder data is processed or maintained

Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit

QUESTION 15
Which statement about the Attestation of Compliance (AOC) is correct?

There are different AOC templates for service providers and merchants

The AOC must be signed by both the merchant/service provider and by PCI SSC

The same AOC template is used for ROCs and SAQs

The AOC must be signed by either the merchant service provider or the QSA’ISA

QUESTION 16
Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

QUESTION 17
Which of the following is true regarding internal vulnerability scans?

They must be performed after a significant change

They must be performed by an Approved Scanning Vendor (ASV)

They must be performed by QSA personnel

They must be performed at least annually

QUESTION 18
What do PCI DSS requirements for protecting cryptographic keys include?

Public keys must be encrypted with a key-encrypting key.

Data-encrypting keys must be stronger than the key-encrypting key that protects it.

Private or secret keys must be encrypted, stored within an SCD or stored as key components

Key-encrypting keys and data-encrypting keys must be assigned to the same key custodian

QUESTION 19
In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place”?

Details of the entity s project plan for implementing the requirement

Details of how the assessor observed the entity s systems were compliant with the requirement

Details of the entity s reason for not implementing the requirement

Details of how the assessor observed the entity s systems were not compliant with the requirement

QUESTION 20
If disk encryption is used to protect account data what requirement should be met for the disk encryption solution?

Access to the disk encryption must be managed independently of the operating system access control mechanisms

The disk encryption system must use the same user account authenticator as the operating system

The decryption keys must be associated with the local user account database

The decryption keys must be stored within the local user account database

QUESTION 21
Which of the following statements is true regarding track equivalent data on the chip of a payment card?

It is allowed to be stored by merchants after authorization if encrypted

It is sensitive authentication data

It is out of scope for PCI DSS

It is not applicable for PCI DSS Requirement 3.2

QUESTION 22
A retail merchant has a server room containing systems that store encrypted PAN data. The merchant has implemented a badge access-control system that identities who entered and exited the room onwhat date and at what time There are no video cameras located in the server room Based on this information, which statement is true regarding PCI DSS physical security requirements?

The badge access-control system must be protected from tampering or disabling

The merchant must install video cameras in addition to the existing access-control system

Data from the access-control system must be securely deleted on a monthly basis

The merchant must install motion-sensing alarms in addition to the existing access-control system

QUESTION 23
What does the PCI PTS standard cover?

Point-of-interaction devices used to protect account data

Secure coding practices for commercial payment applications.

Development of strong cryptographic algorithms

End-to-end encryption solutions for transmission of account data

QUESTION 24
An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

QUESTION 25
According torequirement 1,what is the purpose of “Network Security Controls?

Manage anti-malware throughout the CDE.

Control network traffic between two or more logical or physical network segments.

Discover vulnerabilities and rank them

Encrypt PAN when stored

QUESTION 26
Which of the following is true regarding compensating controls?

A compensating control is not necessary if all other PCI DSS requirements are in place

A compensating control must address the risk associated with not adhering to the PCI DSS requirement

An existing PCI DSS requirement can be used as compensating control if it is already implemented

A compensating control worksheet is not required if the acquirer approves the compensating control

QUESTION 27
An internal NTP server that provides lime services to the Cardholder Data Environment is?

Only in scope if it provides time services to database servers.

Not in scope for PCI DSS

Only m scope if it stores processes or transmits cardholder data

In scope for PCI DSS

QUESTION 28
At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?

Authorization

Clearing

Settlement

Chargeback

QUESTION 29
An entity wants to use the Customized Approach. They are unsure how to complete the Controls Matrix or TRA During the assessment, you spend time completing the Controls Matrix and the TRA. while also ensuing that the customized control is implemented securely Which of the following statements is true?

You can assess the customized control but another assessor must verify that you completed the TRA correctly

You can assess the customized control and verify that the customized approach was correctly followed but you must document this in the ROC

You must document the work on the customized control in the ROC but you can not assess the control or the documentation

Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA

QUESTION 30
Which statement is true regarding the presence of both hashed and truncated versions ofthe same PAN in an environment?

Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions

The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.

The hashed and truncated versions must be correlated so the source PAN can be identified

Hashed and truncated versions of a PAN must not exist in same environment

QUESTION 31
Viewing of audit log files should be limited to?

Individuals who performed the logged activity

Individuals with read/write access

Individuals with administrator privileges

Individuals with a job-related need

QUESTION 32
What should the assessor verify when testing that cardholder data is protected whenever it is sent over open public networks?

The security protocol is configured to accept all digital certificates

A proprietary security protocol is used

The security protocol accepts only trusted keys

The security protocol accepts connections from systems with lower encryption strength than required by the protocol

QUESTION 33
An entity accepts e-commerce payment card transactions and stores account data in a database The database server and the web server are both accessible from the Internet The database server and the web server are on separate physical servers. What is required for the entity to meet PCI DSS requirements7

The web server and the database server should be installed on the same physical server

The database server should be relocated so that it is not accessible from untrusted networks

The web server should be moved into the internal network

The database server should be moved to a separate segment from the web server to allow for more concurrent connections