Free Assessor_New_V4 Exam Files Verified & Correct Answers Downloaded Instantly
Instant Download Assessor_New_V4 Dumps Q&As Provide PDF&Test Engine
NEW QUESTION # 19
Which of the following is required to be included in an incident response plan?
- A. Procedures for notifying PCI SSC of the security incident
- B. Procedures for responding to the detection of unauthorized wireless access points
- C. Procedures forlaunching a reverse-attack on the individual(s) responsible for the security incident
- D. Procedures for securely deleting incident response records immediately upon resolution of the incident
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, procedures for securely deleting incident response records immediately upon resolution of the incident must be included in an incident response plan. This is one of the requirements for ensuring that incident response records are not retained indefinitely
NEW QUESTION # 20
What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?
- A. The security protocol is configured to accept all digital certificates
- B. The PAN is encrypted with strong cryptography
- C. The PAN is securely deleted once the transmission has been sent
- D. The security protocol is configured to support earlier versions
Answer: B
Explanation:
Explanation
when PAN is sent over the Internet, PAN must be encrypted with strong cryptography, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 21
Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?
- A. Access to time configuration settings is available to all users of the system.
- B. Each internal system peersdirectorywith an external source to ensure accuracy of time updates
- C. Central time servers receive time signals from specific, approved external sources
- D. Each internal system is configured to be its own time server.
Answer: C
Explanation:
Explanation
critical systems must have correct and consistent time, which means they should use a reliable time source and synchronize their clocks with other systems. This is one of the requirements for ensuring that critical systems have accurate time.
NEW QUESTION # 22
At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?
- A. Chargeback
- B. Authorization
- C. Clearing
- D. Settlement
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, settlement occurs when a merchant receives payment from a card issuer for a completed transaction and delivers goods or services to a customer or another party as agreed upon in advance by both parties, subject to any conditions imposed by either party upon delivery or payment, including but not limited to acceptance, rejection, return, exchange, refund, cancellation, modification, suspension, termination or revocation by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment;
NEW QUESTION # 23
A "Partial Assessment is a new assessment result What is a 'Partial Assessment'?
- A. An interim result before the final ROC has been completed
- B. A ROC that has been completed after using an SAQ to determine which requirements should be tested.
As per FAQ 1331. (As long as the entity meets the SAQs eligibility criteria) - C. A term used by payment brands and acquirers to describe entities that have multiple payment channels with each channel having its own assessment
- D. An assessment with at least one requirement marked as Not Tested*
Answer: D
Explanation:
Explanation
According to requirement 3.1.2, an assessment with at least one requirement marked as Not Tested is considered a partial assessment, which means it does not meet all the requirements and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1. This is one of the requirements for ensuring that assessments are conducted in accordance with PCI DSS.
NEW QUESTION # 24
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)
- A. DES256
- B. ROT 13
- C. RSA512
- D. AES 128
Answer: A
Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the new key must have an appropriate strength for its intended use, which means it should have a sufficient length and complexity to resist brute-force attacks. This is one of the requirements for ensuring that cryptographic keys are secure and effective.
NEW QUESTION # 25
The intent of assigning a risk ranking to vulnerabilities is to?
- A. Prioritize the highest risk items so they can be addressed more quickly
- B. Ensure that critical security patches are installed at least quarterly
- C. Ensure all vulnerabilities are addressed within 30 days
- D. Replace the need toquarterly ASV scans
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the intent of assigning a risk ranking to vulnerabilities is to prioritize the highest risk items so they can be addressed more quickly, rather than ensuring all vulnerabilities are addressed within 30 days or replacing the need to quarterly ASV scans or ensuring that critical security patches are installed at least quarterly. This is one of the requirements for ensuring that vulnerabilities are identified and mitigated as soon as possible.
NEW QUESTION # 26
Which of the following describes the intent of installing one primary function per server?
- A. To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server - B. To allow functions with different security levels to be implemented on the same server
- C. To allow higher-security functions to protect lower-security functions installed on the same server
- D. To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, installing one primary function per server is intended to prevent server functions with a lower security level from introducing security weaknesses to higher-security functions on the same server. This is one of the requirements for ensuring that server functions are isolated from each other.
NEW QUESTION # 27
What should the assessor verify when testing that cardholder data is protected whenever it is sent over open public networks?
- A. The security protocol accepts connections from systems with lower encryption strength than required by the protocol
- B. The security protocol is configured to accept all digital certificates
- C. A proprietary security protocol is used
- D. The security protocol accepts only trusted keys
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the security protocol accepts only trusted keys.
This is one of the requirements for ensuring secure encryption and authentication.
NEW QUESTION # 28
Security policies and operational procedures should be?
- A. Stored securely so that only management has access
- B. Reviewed and updated at least quarterly
- C. Encrypted with strong cryptography
- D. Distributed to and understood by all affected parties
Answer: D
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, security policies and operational procedures should be distributed to and understood by all affected parties, such as management, staff, contractors, vendors, and service providers. This is one of the requirements for ensuring that security policies and operational procedures are communicated and followed consistently.
NEW QUESTION # 29
Which of the following is a requirement for multi-tenant service providers?
- A. Ensure that customers cannot access another entity s cardholder data environment
- B. Ensure that a customer's log files are available to all hosted entities
- C. Provide customers with a shared user ID for access to critical system binaries
- D. Provide customers with access to the hosting provider s system configuration files.
Answer: A
Explanation:
Explanation
According to requirement 3.1.2, multi-tenant service providers must ensure that customers cannot access another entity's cardholder data environment, which means they should isolate each customer's cardholder data from other customers' cardholder data and prevent unauthorized access or disclosure. This is one of the requirements for ensuring that multi-tenant service providers protect each customer's cardholder data.
NEW QUESTION # 30
Which statement about PAN is true?
- A. It does not require protection for transmission over public wired networks
- B. It does not require protection for transmission over public wireless networks
- C. It must be protected with strong cryptography (or transmission over private wired networks
- D. It must be protected with strong cryptography for transmission over private wireless networks
Answer: D
Explanation:
Explanation
According to requirement 4, PAN must be protected with strong cryptography for transmission over private wireless networks, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception of cardholder data over wireless networks. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
NEW QUESTION # 31
Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?
- A. Virtual LANs that route network traffic between the CDE and out-of-scope networks
- B. A network configuration that prevents all network traffic between the CDE and out-of-scope networks
- C. Firewalls that log all network traffic flows between the CDE and out of-scope networks
- D. Routers that monitor network traffic flows between the CDE and out-of-scope networks
Answer: A
Explanation:
Explanation
Segmentation is a method of isolating system components that store, process, or transmit cardholder data from systems that do not, by using security controls such as firewalls, routers, switches, or other devices1. Segmentation can reduce the scope of the cardholder data environment (CDE) and thus reduce the scope of the PCI DSS assessment, as only the systems and networks within the CDE or connected to the CDE are subject to PCI DSS requirements2. Virtual LANs (VLANs) are one example of such a security control, as they can create logical subnetworks that separate different types of traffic and restrict access between them3.
Therefore, the correct answer is option C.
The other options are not true regarding the scenario that describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope. Option A is not true because routers that monitor network traffic flows between the CDE and out-of-scope networks are not sufficient to isolate the CDE, as they do not prevent or limit the traffic flows. Option B is not true because firewalls that log all network traffic flows between the CDE and out-of-scope networks are not sufficient to isolate the CDE, as they do not block or filter the traffic flows. Option D is not true because a network configuration that prevents all network traffic between the CDE and out-of-scope networks is not realistic or feasible, as some traffic may be necessary for business or legal reasons, such as payment processing, reporting, or auditing. References:
Network Segmentation - PCI Security Standards Council
Guidance for PCI DSS Scoping and Network Segmentation
VLANs and PCI Compliance: What You Need to Know
NEW QUESTION # 32
A sample of business facilities is reviewed during the PCI DSS assessment What is the assessor required to validate about the sample?
- A. Every facility where cardholder data is stored is reviewed
- B. All types and locations of facilities are represented
- C. The number of facilities in the sample is at least 10 percent of the total number of facilities
- D. It includes a consistent set of facilities that are reviewed for all assessments.
Answer: D
Explanation:
Explanation
when a sample of business facilities is reviewed during a PCI DSS assessment, the assessor will verify that it includes a consistent set of facilities that are reviewed for all assessments, which means it should cover all types and locations of facilities where cardholder data is stored. This is one of the requirements for ensuring that all facilities are reviewed.
NEW QUESTION # 33
In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place''?
- A. Details of the entity s reason for not implementing the requirement
- B. Details of how the assessor observed the entity s systems were not compliant with the requirement
- C. Details of the entity s project plan for implementing the requirement
- D. Details of how the assessor observed the entity s systems were compliant with the requirement
Answer: D
Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity's systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.
NEW QUESTION # 34
If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?
- A. Verify that approved devices and applications are used for the segmentation controls
- B. Verify the payment card brands have approved the segmentation
- C. Verify the controls used for segmentation are configured properly and functioning as intended
- D. Verify the segmentation controls allow only necessary traffic into the cardholder data environment.
Answer: D
Explanation:
Explanation
According to requirement 3.1.2, if segmentation is being used to reduce the scope of a PCI DSS assessment, the assessor will verify that the segmentation controls allow only necessary traffic into the cardholder data environment, which means they should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
NEW QUESTION # 35
An entity is using custom software in their CDE.The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard.What impact will this have on the entity's PCI DSS assessment?
- A. There is no impact to the entity
- B. It may help the entity to meet several requirements in Requirement 6.
- C. The custom software can be excluded from the PCI DSS assessment
- D. It automatically makes an entity PCI DSS compliant
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, there is no impact to the entity if custom software in their CDE was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard. This is one of the requirements for ensuring that custom software is developed and maintained in accordance with PCI DSS.
NEW QUESTION # 36
Which of the following can be sampled for testing during a PCI DSS assessment?
- A. Business facilities and system components
- B. Compensating controls
- C. Security policies and procedures
- D. PCI DSS requirements and testing procedures.
Answer: A
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, business facilities and system components can be sampled for testing during a PCI DSS assessment, as long as they are not critical components or components that are not in scope for testing. This is one of the requirements for ensuring that testing covers all relevant components and processes.
NEW QUESTION # 37
An LDAP server providing authentication services to the cardholder data environment is
- A. in scope only if it provides authentication services to systems in the DMZ
- B. in scope for PCI DSS.
- C. in scope only if it stores processes or transmits cardholder data
- D. not in scope for PCI DSS
Answer: C
Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an LDAP server providing authentication services to the cardholder data environment is in scope only if it provides authentication services to systems in the DMZ. This is one of the requirements for preventing unauthorized access to cardholder data.
NEW QUESTION # 38
Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?
- A. Cryptographic key components from the retired key must be retained for 3 months before disposal
- B. All data encrypted under the retired key must be securely destroyed
- C. A new key custodian must be assigned
- D. The retired key must not be used for encryption operations
Answer: B
Explanation:
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, all data encrypted under the retired key must be securely destroyed, which means it should be overwritten with random data or deleted from the storage device. This is one of the requirements for ensuring that data encryption keys are not reused or compromised.
NEW QUESTION # 39
......
Exam Valid Dumps with Instant Download Free Updates: https://www.testbraindump.com/Assessor_New_V4-exam-prep.html
Fast Exam Updates Assessor_New_V4 dumps with PDF Test Engine Practice: https://drive.google.com/open?id=14MK3DjYEPZV-nTMpjnemh8wzL-DQZm3y
