NEW QUESTION 34
Users passwords/passphrases should be changed on a minimal of what interval to meet Requirement
8 .2.4?

NEW QUESTION 35
Imprint-Only Merchants with no electronic storage of cardholder data may be eligible to use which SAQ?

NEW QUESTION 36
Merchants involved with only card-not-present transactions that are completely outsourced to a PCI DSS complaint service provider may be eligible to use?

NEW QUESTION 37
The Information Supplements: (Select ALL that apply)

NEW QUESTION 38
The implementation of a Security Awareness Program (Requirement 12.6) requires that personnel must be educated upon hire and at least

NEW QUESTION 39
Which of the following entities will ultimately approve a purchase?

NEW QUESTION 40
Existing PCI DSS requirements may be combined with new controls to become a compensating control.

NEW QUESTION 41
Requirement 8.2.3 states that passwords/phrases must contain both numeric and alphabetic characters and a minimum length of at least

NEW QUESTION 42
Intrusion-detection and/or intrusion-prevention techniques are NOT a requirement to monitor all traffic at the perimeter of the cardholder data environment as well as at critical points in the CDE and alert personnel to suspected compromises.

NEW QUESTION 43
PCI Requirement 12.6 requires personnel to acknowledge at least _______ that they have read and understood the security policy and procedures.

NEW QUESTION 44
Merchants using only web-based virtual payment terminals, no electronic cardholder data storage, may be eligible to use what SAQ?

NEW QUESTION 45
What is the NIST standards that provides password complexity requirements

NEW QUESTION 46
Requirement 3.5 requires document and implement procedures to protect keys used to secure stored cardholder data against disclose and misuse. This requirement applies to keys used to encrypt stored cardholder data, and also applies to key-encrypting keys used to protect data-encrypting keys. Such key-encrypting keys must be

NEW QUESTION 47
According to requirement 8.1.6 an user ID should be locked out after a maximum how many repeated access attempts?

NEW QUESTION 48
Requirement 11.3 – Implement a methodology for penetration testing is a best practice until June 30 2015

NEW QUESTION 49
To be compliant with requirement 8.1.4 you have to remove/disable inactive user accounts at least every

NEW QUESTION 50
Please select all possible disciplinary actions that may be applicable in case of violation of PCI Code of
Professional Responsibility

NEW QUESTION 51
The lockout of an user ID should be set until an administrator re-enables the user or to a minimum of

NEW QUESTION 52
Compensating controls must: (Select ALL that applies)

NEW QUESTION 53
What is the Appendix A on PCI DSS 3.0?

NEW QUESTION 54
An user should be required to re-authenticate to activate the terminal or session if it’s been idle for more than

NEW QUESTION 55
PCI DSS Requirement Appendix A is intended for:

NEW QUESTION 56
The use of two-factor authentication is NOT a requirement on PCI DSS v3 for remote network access originating from outside the network by personnel and all third parties.

NEW QUESTION 57
SELECT ALL THAT APPLY
Select all audit trails that must be recorded for all system components according to requirement 10.3