Question 1

Which of the following fines can be applied to all organizations under PCI regulation?

Accepted Answer

A)  DCRS for compromised international-issued cards 
B)  PCI noncompliance 
C)  ADCR for compromised domestic-issued cards 
D)  All of the above 
A)  DCRS for compromised international-issued cards 
B)  PCI noncompliance 
C)  ADCR for compromised domestic-issued cards 
D)  All of the above D

Question 2

Which of the following merchant level categories includes any merchant-regardless of acceptance channel-processing one million to six million Visa transactions per year?

Accepted Answer

A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4 
A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4 B

Question 3

PCI compliance validation is composed of four merchant levels. Which of the following levels requires conducting an annual onsite evaluation?

Accepted Answer

A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4 
A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4 A

Question 4

Which of the following refers to a document that Qualified Security Assessors (QSAs) use to validate organizations that must be PCI DSS-compliant?

Accepted Answer

A)  DESV 
B)  FCBA 
C)  EFTA 
D)  QSA 
A)  DESV 
B)  FCBA 
C)  EFTA 
D)  QSA

Question 5

Which of the following requirements is part of the "Protect cardholder data" PCI DSS core principle?

Accepted Answer

A)  Maintain a policy that addresses cybersecurity for all personnel. 
B)  Develop and maintain secure systems and architecture. 
C)  Restrict physical access to cardholder data. 
D)  Protect stored card data. 
A)  Maintain a policy that addresses cybersecurity for all personnel. 
B)  Develop and maintain secure systems and architecture. 
C)  Restrict physical access to cardholder data. 
D)  Protect stored card data.

Question 6

Which of the following is considered sensitive authentication data?

Accepted Answer

A)  Expiration date 
B)  Primary account number 
C)  Full magnetic stripe data 
D)  Cardholder name 
A)  Expiration date 
B)  Primary account number 
C)  Full magnetic stripe data 
D)  Cardholder name

Question 7

The Fair Credit Billing Act (FCBA) states that the maximum liability for unauthorized credit card use is how much?

Accepted Answer

A)  $25 
B)  $50 
C)  $75 
D)  $100 
A)  $25 
B)  $50 
C)  $75 
D)  $100

Question 8

Which of the following statements best describes a data security compliance assessment?

Accepted Answer

A)  A self-assessment questionnaire 
B)  An annual onsite evaluation of compliance with PCI DSS 
C)  A compliance requirement conducted by the merchant bank 
D)  A compliance report submitted by the internal security assessor 
A)  A self-assessment questionnaire 
B)  An annual onsite evaluation of compliance with PCI DSS 
C)  A compliance requirement conducted by the merchant bank 
D)  A compliance report submitted by the internal security assessor

Question 9

Which of the following is not considered sensitive authentication data?

Accepted Answer

A)  Full magnetic stripe data 
B)  CAV2 code 
C)  Expiration date 
D)  CVC2 code 
A)  Full magnetic stripe data 
B)  CAV2 code 
C)  Expiration date 
D)  CVC2 code

Question 10

Which of the following is not an example of cardholder data?

Accepted Answer

A)  Primary account number 
B)  PIN number 
C)  Service code 
D)  Expiration date 
A)  Primary account number 
B)  PIN number 
C)  Service code 
D)  Expiration date

Question 11

Which of the following PCI compliance validation levels includes requirements that are set by the merchant bank?

Accepted Answer

A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4 
A)  Level 1 
B)  Level 2 
C)  Level 3 
D)  Level 4

Question 12

Which category of the PCI DSS self-assessment questionnaire (SAQ) is applicable only to e-commerce channels who outsource all payment processing to PCI DSS validated third-party providers?

Accepted Answer

A)  SAQ A 
B)  SAQ A-EP 
C)  SAQ B 
D)  SAQ P2PE 
A)  SAQ A 
B)  SAQ A-EP 
C)  SAQ B 
D)  SAQ P2PE

Question 13

Which of the following refers to organizations that validate adherence to certain PCI DSS requirements by performing vulnerability scans of Internet-facing environments of merchants and service providers?

Accepted Answer

A)  Qualified Security Assessors (QSAs) 
B)  Internal Security Assessors (ISAs) 
C)  Approved Scanning Vendors (ASVs) 
D)  None of the above 
A)  Qualified Security Assessors (QSAs) 
B)  Internal Security Assessors (ISAs) 
C)  Approved Scanning Vendors (ASVs) 
D)  None of the above

Question 14

According to the Federal Trade Commission, consumers reported how much in losses due to fraud each year during the last few years?

Accepted Answer

A)  More than $90 million 
B)  More than $125 million 
C)  More than $550 million 
D)  More than $900 million 
A)  More than $90 million 
B)  More than $125 million 
C)  More than $550 million 
D)  More than $900 million

Question 15

According to the PCI Security Standards Council (PCI SSC), which of the following refers to any entity that accepts American Express, Discover, JCB, MasterCard, or Visa as payment for goods and/or services?

Accepted Answer

A)  Acquirer 
B)  Service provider 
C)  Merchant 
D)  Approved Scanning Vendor (ASV) 
A)  Acquirer 
B)  Service provider 
C)  Merchant 
D)  Approved Scanning Vendor (ASV)

Question 16

Which of the following is considered cardholder data?

Accepted Answer

A)  Service code 
B)  Full magnetic stripe data 
C)  Security code 
D)  PIN 
A)  Service code 
B)  Full magnetic stripe data 
C)  Security code 
D)  PIN

Question 17

Which of the following requirements is part of the "Maintain a vulnerability management program" PCI DSS core principle?

Accepted Answer

A)  Install and maintain a firewall configuration to protect cardholder data. 
B)  Develop and maintain secure systems and architecture. 
C)  Protect all systems against malware and regularly update antivirus software. 
D)  Encrypt transmission of cardholder data across open, public networks. 
A)  Install and maintain a firewall configuration to protect cardholder data. 
B)  Develop and maintain secure systems and architecture. 
C)  Protect all systems against malware and regularly update antivirus software. 
D)  Encrypt transmission of cardholder data across open, public networks.

Question 18

Which of the following requirements is part of the "Implement strong access control measures" PCI DSS core principle?

Accepted Answer

A)  Restrict access to cardholder data by business need-to know. 
B)  Develop and maintain secure systems and applications. 
C)  Protect all systems against malware and regularly update antivirus software. 
D)  Encrypt transmission of cardholder data across open, public networks. 
A)  Restrict access to cardholder data by business need-to know. 
B)  Develop and maintain secure systems and applications. 
C)  Protect all systems against malware and regularly update antivirus software. 
D)  Encrypt transmission of cardholder data across open, public networks.

Question 19

Which of the following requirements is part of the "Build and maintain a secure network and systems" PCI DSS core principle?

Accepted Answer

A)  Protect stored card data. 
B)  Restrict physical access to cardholder data. 
C)  Do not use vendor-supplied defaults for system passwords and security parameters. 
D)  Track and monitor all access to network resources and cardholder data. 
A)  Protect stored card data. 
B)  Restrict physical access to cardholder data. 
C)  Do not use vendor-supplied defaults for system passwords and security parameters. 
D)  Track and monitor all access to network resources and cardholder data.

Question 20

Which of the following refers to organizations that have been qualified by the PCI Security Standards Council to have their employees assess compliance to the PCI DSS standard?

Accepted Answer

A)  Qualified Security Assessors (QSAs) 
B)  Internal Security Assessors (ISAs) 
C)  Approved Scanning Vendors (ASVs) 
D)  All of the above 
A)  Qualified Security Assessors (QSAs) 
B)  Internal Security Assessors (ISAs) 
C)  Approved Scanning Vendors (ASVs) 
D)  All of the above

Which of the following fines can be applied to all organizations under PCI regulation?

Which of the following merchant level categories includes any merchant-regardless of acceptance channel-processing one million to six million Visa transactions per year?

PCI compliance validation is composed of four merchant levels. Which of the following levels requires conducting an annual onsite evaluation?

Which of the following refers to a document that Qualified Security Assessors (QSAs) use to validate organizations that must be PCI DSS-compliant?

Which of the following requirements is part of the "Protect cardholder data" PCI DSS core principle?

Which of the following is considered sensitive authentication data?

The Fair Credit Billing Act (FCBA) states that the maximum liability for unauthorized credit card use is how much?

Which of the following statements best describes a data security compliance assessment?

Which of the following is not considered sensitive authentication data?

Which of the following is not an example of cardholder data?

Which of the following PCI compliance validation levels includes requirements that are set by the merchant bank?

Which category of the PCI DSS self-assessment questionnaire (SAQ) is applicable only to e-commerce channels who outsource all payment processing to PCI DSS validated third-party providers?

Which of the following refers to organizations that validate adherence to certain PCI DSS requirements by performing vulnerability scans of Internet-facing environments of merchants and service providers?

According to the Federal Trade Commission, consumers reported how much in losses due to fraud each year during the last few years?

According to the PCI Security Standards Council (PCI SSC), which of the following refers to any entity that accepts American Express, Discover, JCB, MasterCard, or Visa as payment for goods and/or services?

Which of the following is considered cardholder data?

Which of the following requirements is part of the "Maintain a vulnerability management program" PCI DSS core principle?

Which of the following requirements is part of the "Implement strong access control measures" PCI DSS core principle?

Which of the following requirements is part of the "Build and maintain a secure network and systems" PCI DSS core principle?

Which of the following refers to organizations that have been qualified by the PCI Security Standards Council to have their employees assess compliance to the PCI DSS standard?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Cybersecurity Incident Response

Business Continuity Management

Regulatory Compliance for Financial Institutions

Regulatory Compliance for the Health-Care Sector

Nist Cybersecurity Framework

Filters

Exam 15: PCI Compliance for Merchants

Which of the following fines can be applied to all organizations under PCI regulation?

Which of the following merchant level categories includes any merchant-regardless of acceptance channel-processing one million to six million Visa transactions per year?

PCI compliance validation is composed of four merchant levels. Which of the following levels requires conducting an annual onsite evaluation?

Which of the following refers to a document that Qualified Security Assessors (QSAs) use to validate organizations that must be PCI DSS-compliant?

Which of the following requirements is part of the "Protect cardholder data" PCI DSS core principle?

Which of the following is considered sensitive authentication data?

The Fair Credit Billing Act (FCBA) states that the maximum liability for unauthorized credit card use is how much?

Which of the following statements best describes a data security compliance assessment?

Which of the following is not considered sensitive authentication data?

Which of the following is not an example of cardholder data?

Which of the following PCI compliance validation levels includes requirements that are set by the merchant bank?

Which category of the PCI DSS self-assessment questionnaire (SAQ) is applicable only to e-commerce channels who outsource all payment processing to PCI DSS validated third-party providers?

Which of the following refers to organizations that validate adherence to certain PCI DSS requirements by performing vulnerability scans of Internet-facing environments of merchants and service providers?

According to the Federal Trade Commission, consumers reported how much in losses due to fraud each year during the last few years?

According to the PCI Security Standards Council (PCI SSC), which of the following refers to any entity that accepts American Express, Discover, JCB, MasterCard, or Visa as payment for goods and/or services?

Which of the following is considered cardholder data?

Which of the following requirements is part of the "Maintain a vulnerability management program" PCI DSS core principle?

Which of the following requirements is part of the "Implement strong access control measures" PCI DSS core principle?

Which of the following requirements is part of the "Build and maintain a secure network and systems" PCI DSS core principle?

Which of the following refers to organizations that have been qualified by the PCI Security Standards Council to have their employees assess compliance to the PCI DSS standard?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Cybersecurity Incident Response

Business Continuity Management

Regulatory Compliance for Financial Institutions

Regulatory Compliance for the Health-Care Sector

Nist Cybersecurity Framework

Filters