Assessor_New_V4 Exam Dumps - PCI SSC Certification Questions and Answers

critical systems must have correct and consistent time, which means they should use a reliable time source and synchronize their clocks with other systems. This is one of the requirements for ensuring that critical systems have accurate time.

According to requirement 4, an entity must monitor its TPSP’s PCI DSS compliance status at least annually, which means it should review its TPSP’s policies and procedures for protecting cardholder data and transactions against fraud and other threats at least once a year. This is one of the requirements for ensuring that an entity monitors its TPSP’s PCI DSS compliance status regularly.

According to the PCI DSS v3.2.1 Quick Reference Guide1, private or secret keys must be encrypted, stored within an SCD or stored as key components. This is one of the requirements for ensuring secure encryption and authentication.

The Secure SLC standard is one of the two standards that are part of the PCI Software Security Framework (SSF), which provides security requirements and assessment procedures for software vendors to integrate into their software development lifecycles and to validate that secure lifecycle management practices are in place12. The Secure SLC standard is designed to offer a more flexible approach to how the security and integrity of payment software is tested, and to address the evolving threat landscape and changes in software development practices3.

The PCI DSS Requirement 6 states that entities must develop and maintain secure systems and applications, and it includes several sub-requirements that cover variousaspects of software security, such as change control, secure coding, vulnerability management, and patching4. By using custom software that is compliant with the Secure SLC standard, an entity may be able to meet some or all of these sub-requirements, as the Secure SLC standard covers similar topics and ensures that the software is developed and maintained in a secure manner throughout its entire lifecycle1. However, this does not automatically make the entity PCI DSS compliant, as there are other requirements and controls that the entity must implement and validate, such as network security, access control, monitoring, and incident response4. Therefore, the correct answer is option B.

The other options are not true regarding the impact of using custom software that is compliant with the Secure SLC standard on the PCI DSS assessment. Option A is not true because, as explained above, the entity still has to comply with other PCI DSS requirements and controls that are not covered by the Secure SLC standard. Option C is not true because there is a positive impact to the entity, as it may help the entity to meet several requirements in Requirement 6 and to demonstrate that the custom software is secure and reliable. Option D is not true because the custom software cannot be excluded from the PCI DSS assessment, as it is part of the cardholder data environment (CDE) and it may store, process, or transmit cardholder data or sensitive authentication data. The entity must ensure that the custom software meets the PCI DSS requirements and controls that are applicable to it, and that the assessor validates its compliance4. References:

• Software Security Framework Secure Software Life Cycle (Secure SLC) Standard
• PCI Security Standards Council Publishes Version 1.1 of Secure Software Lifecycle (SLC) Standard and Program
• PCI Security Standards Council Publishes Version 1.1 of Secure Software Standard and Program
• PCI DSS v3.2.1

According to the PCI DSS v3.2.1 Quick Reference Guide1, an internal NTP server that provides time services to the cardholder data environment is in scope for PCI DSS if it stores processes or transmits cardholder data, regardless of whether it provides authentication services to systems in the DMZ or not. This is one of the requirements for preventing unauthorized access to cardholder data using time services.

According to the PCI DSS v3.2.1 Quick Reference Guide1, assigning a unique ID to each person is intended to ensure individual users are accountable for their own actions, rather than shared accounts or group accounts based on need-to-know. This is one of the requirements for ensuring that user accounts are properly managed and controlled.

PCI DSS Requirement 11.5 states that entities must deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly1. This is to ensure that any unauthorized or malicious changes to the files are detected and reported in a timely manner, and that the integrity and security of the files are maintained. Critical files are those that affect the security of the cardholder data environment (CDE), such as system files, application executables, configuration files, database files, and log files2. Therefore, the correct answer is option A.

The other options are not true regarding the frequency of critical file comparisons for a change-detection mechanism. Option B is not true because PCI DSS does not allow the entity to define the periodicity of the file comparisons, as it specifies a minimum frequency of at least weekly1. Option C is not true because PCI DSS does not limit the file comparisons to only after a valid change is installed, as it requires the file comparisons to be performed at least weekly regardless of the change status1. Option D is not true because PCI DSS does not allow the file comparisons to be performed at least monthly, as it requires a higher frequency of at least weekly1. References:

• PCI DSS v3.2.1
• File Integrity Monitoring Tools For PCI DSS

an entity can use both the Customized Approach and the Defined Approach to meet the same requirement, as long as it uses compensating controls to address any weaknesses or gaps inthe customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.

PCI DSS Requirement 9.1.1 requires entities to use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment (CDE)1. A badge access-control system is one example of such a control, as it can identify who entered and exited the server room and when. However, this control is only effective if it is protected from tampering or disabling by unauthorized persons, as PCI DSS Requirement 9.1.2 states1. Otherwise, the access-control system could be bypassed or compromised, allowing unauthorized access to the systems that store encrypted PAN data. Therefore, the badge access-control system must be protected from tampering or disabling, as stated in option A.

The other options are not true regarding PCI DSS physical security requirements for a server room. Option B is not true because PCI DSS does not mandate the use of video cameras in addition to the existing access-control system, although it is a recommended best practice2. Option C is not true because PCI DSS does not specify a data retention period for the access-control system, although it requires entities to retain audit trail history for at least one year, with a minimum of three months immediately available for analysis3. Option D is not true because PCI DSS does not require the use of motion-sensing alarms in addition to the existing access-control system, although it is another recommended best practice2. References:

• PCI DSS v3.2.1
• PCI DSS Requirement 9: Upping Your Physical Security
• PCI DSS Requirement 10: Track and Monitor All Access to Network Resources and Cardholder Data

According to the PCI DSS v3.2.1 Quick Reference Guide1, installing one primary function per server is intended to prevent server functions with a lower security level from introducingsecurity weaknesses to higher-security functions on the same server. This is one of the requirements for ensuring that server functions are isolated from each other.