Released PCI SSC Assessor_New_V4 Updated Questions PDF [Q17-Q31]

admin Assessor_New_V4 PCI SSC November 1, 2023

Rate this post

Released PCI SSC Assessor_New_V4 Updated Questions PDF

Assessor_New_V4 Dumps and Practice Test (62 Exam Questions)

NO.17 Viewing of audit log files should be limited to?

Individuals who performed the logged activity

Individuals with read/write access

Individuals with administrator privileges

Individuals with a job-related need

NO.18 Which statement about the Attestation of Compliance (AOC) is correct?

There are different AOC templates for service providers and merchants

The AOC must be signed by both the merchant/service provider and by PCI SSC

The same AOC template is used for ROCs and SAQs

The AOC must be signed by either the merchant service provider or the QSA’ISA

NO.19 Which of the following is true regarding compensating controls?

A compensating control is not necessary if all other PCI DSS requirements are in place

A compensating control must address the risk associated with not adhering to the PCI DSS requirement

An existing PCI DSS requirement can be used as compensating control if it is already implemented

A compensating control worksheet is not required if the acquirer approves the compensating control

NO.20 Which of the following is an example of multi-factor authentication?

A token that must be presented twice during the login process

A user passphrase and an application level password.

A user password and a PIN-activated smart card

A user fingerprint and a user thumbprint

NO.21 What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)

DES256

RSA512

AES 128

ROT 13

NO.22 An entity wants to know if the Software Security Framework can be leveraged during their assessment Which of the following software types would this apply to?

Any payment software in the CDE

Only software which runs on PCI PTS devices

Validated Payment Applications that are listed by PCI SSC and have undergone a PA-DSS assessment

Software developed by the entity in accordance with the Secure SLC Standard

NO.23 Assigning a unique ID to each person is intended to ensure?

Strong passwords are used for each user account

Shared accounts are only used by administrators

Individual users are accountable for their own actions

Access is assigned to group accounts based on need-to-know

NO.24 The intent of assigning a risk ranking to vulnerabilities is to?

Ensure all vulnerabilities are addressed within 30 days

Replace the need toquarterly ASV scans

Prioritize the highest risk items so they can be addressed more quickly

Ensure that critical security patches are installed at least quarterly

NO.25 An organization wishes to implement multi-factor authentication for remote access, using the user’s individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?

Certificates are logged so they can be retrieved when the employee leaves the company

Change control processes are in place to ensue certificates are changed every 90 days

Certificates are assigned only to administrative groups and not to regular users

A different certificate is assigned to each individual user account, and certificates are not shared

NO.26 Which statement about PAN is true?

It must be protected with strong cryptography for transmission over private wireless networks

It must be protected with strong cryptography (or transmission over private wired networks

It does not require protection for transmission over public wireless networks

It does not require protection for transmission over public wired networks

NO.27 What is the intent of classifying media that contains cardholder data?

Ensuring that media is property protected according to the sensitivity of the data it contains

Ensuring that media containing cardholder data is moved from secured areas an a quarterly basis

Ensuring that media is clearly and visibly labeled as ‘Confidential so all personnel know that the media contains cardholder data

Ensuring that all media is consistently destroyed on the same schedule regardless of the contents

NO.28 Which of the following file types must be monitored by a change-detection mechanism (for example, a file-integrity monitoring tool)?

Application vendor manuals

Files that regularly change

Security policy and procedure documents

System configuration and parameter files

NO.29 An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

At least weekly

Periodically as defined by the entity

Only after a valid change is installed

At least monthly

NO.30 Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?

The retired key must not be used for encryption operations

Cryptographic key components from the retired key must be retained for 3 months before disposal

A new key custodian must be assigned

All data encrypted under the retired key must be securely destroyed

NO.31 Which of the following describes the intent of installing one primary function per server?

To allow functions with different security levels to be implemented on the same server

To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server

To allow higher-security functions to protect lower-security functions installed on the same server

To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

Assessor_New_V4 Exam Dumps Pass with Updated 2023 Certified Exam Questions: https://www.validexam.com/Assessor_New_V4-latest-dumps.html

Released PCI SSC Assessor_New_V4 Updated Questions PDF [Q17-Q31]

Written by admin

Leave a Reply Cancel reply

Assessor_New_V4 Practice Tests

Related Certifications

Recent Posts

Archives

Categories