[Jan 26, 2024] Fully Updated Free Actual PCI CPSA_P_New Exam Questions [Q21-Q43]

NEW QUESTION 21
Which of the follow best describes a Technical FAQ?

Technical FAQs only apply to the specific technology as the FAQ defines it

Technical FAQs can be submitted to PCI SSC at any time

Use of the Technical FAQs is mandatory, they shall be used during an assessment

Use of the Technical FAQs is optional, they are considered guidance

NEW QUESTION 22
Which of the following personnel changes must result in the vendor notifying the Vendor Program Administration (VPA)?

Adding additional rights to someone’s role to give them access to the mam production vault

Any change to a role that directly affects the security of card products and related components

Hiring someone that will directly interact with the card issuers

Promoting someone to senior management level

NEW QUESTION 23
A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Payment brands

Issuing banks

PCI SSC

Assessor

NEW QUESTION 24
During an assessment you walk the perimeter of the building with a guard you find an emergency exit door from the facility and ask the guard what is on the other side. The guard can’t remember, and so uses their assigned, secure key to open the door and show you a corridor within the facility. What most concerns you about the situation?

The exit door should not lead into the facility

The exit door should not be capable of being opened from the outside

The guard should not have forgotten where the door leads to

The guard should have sought permission from their manager before opening the door

NEW QUESTION 25
A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Assessor

Issuing banks

Payment brands

PCI SSC

NEW QUESTION 26
A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

None, only people on the pre-approved list may enter

When they are approved by the physical security manager or senior management

When the third party s liability insurance covers the risk

When no card production activities are taking place

NEW QUESTION 27
You wish to check that you are using the most current version of the Card Production requirements. What should you do?

Have the CPSA Company’s point of contact request the document

Download it from PCI SSC’s Document Library

Email a request for the document to PCI SSC

View it directly via PCI SSC Assessor Portal

NEW QUESTION 28
When must HSA motion detectors generate an alarm event?

Each time movement is detected

Each time movement is detected outside of regular business hours

Each time movement is detected and the access-control system indicates the room is occupied

Each time movement is detected and the access-control system indicates the room is not occupied

NEW QUESTION 29
During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Employee information, including background checks, must be stored for at least seven years

Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

The vendor must retain the background information for at least 18 months after termination of contract

The vendor must only retain background information for all current employees, not for those that have been terminated

NEW QUESTION 30
In which of the following locations must the CCTV and access control servers be located?

Within the secure server room inside of the HSA

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

NEW QUESTION 31
Who is required to approve visitor entry to the HSA or cloud-based provisioning environment?

The head of the vendor facility

The Security Manager

Both the Security Manager and the Production Manager

The Security Manager, Production Manager, and the head of the vendor facility

NEW QUESTION 32
How frequently must alarms on external doors of a card production and provisioning vendor environment be tested?

Every day

Every week

Every month

Every 3 months

NEW QUESTION 33
Where can misprinted, partially finished cards be shredded?

In any HSA room approved by the security manager

Either in the HSA printing room or destruction room

Only in the HSA destruction room

Either in the HSA destruction room or a loading bay that meets all requirements of a destruction room

NEW QUESTION 34
Which of the following statements is true about the facility’s non-emergency exits?

They must be contact-alarm monitored only when card production activities are taking place

They must be configured to prevent staff tailgating

They may be left unlocked when a guard is present

They must be fitted with biometric access-control devices

NEW QUESTION 35
Which of the following must be used by the vendor to protect doors that provide access to buildings containing air conditioning equipment?

Security tape that will leave an observable trace each time a door is opened

Electrical contacts that log each open and close event to a secure system memory

Magnetic contacts that are permanently alarmed and that are connected to the security control-room panels

Physical locks with a limited set of keys under constant supervision by a guard in the security control-room

NEW QUESTION 36
Which of these are guards allowed access to?

HSAs

Audit logs

Loading bays

Physical master keys that provide access to card production or provisioning areas

NEW QUESTION 37
Which of the following must every assessor do to maintain their CPSA certification?

Complete annual requalification training or complete 3 assessments for different facilities each year

Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years

Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)

Submit evidence of internal training in a relevant area (as per the QRs)

NEW QUESTION 38
A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is functioning correctly. When must the status of the access change?

Only when an unauthorised badge is presented

Only when the person has successfully completed the access cycle

Upon initial entry of the person into the device, prior to completion of the access cycle

Upon initial presentation of an authorised badge, prior to completion of the access cycle

NEW QUESTION 39
Which of the following statements about unsolicited visitors is true?

They must be turned away

They must complete an NDA before entry is granted

They must be able to prove a legitimate reason for their visit prior to entry

They must be registered, their identities confirmed, and must be allocated an escort before entry

NEW QUESTION 40
Which of these is a requirement of the security control room?

Access must be controlled by a physical key (in case of power-failure)

Access must be monitored in real-time