Online Access Free QSA_New_V4 Exam Questions

Which of the following parties is responsible for completion of the Controls Matrix for the Customized Approach?

• A.Card brands or acquirer.
• B.Either a QSA, AQSA, or PCIP.
• C.Entity being assessed.
• D.Only a Qualified Security Assessor (QSA).

An entity is using custom software in their CDE. The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard. What impact will this have on the entity's PCI DSS assessment?

• A.The custom software can be excluded from the PCI DSS assessment.
• B.It automatically makes an entity PCI DSS compliant.
• C.There is no impact to the entity.
• D.It may help the entity to meet several requirements in Requirement 6.

What is the intent of classifying media that contains cardholder data?

• A.Ensuring that media is clearly and visibly labeled as "Confidential" so all personnel know that the media contains cardholder data.
• B.Ensuring that media containing cardholder data is moved from secured areas on a quarterly basis.
• C.Ensuring that all media is consistently destroyed on the same schedule, regardless of the contents.
• D.Ensuring that media is properly protected according to the sensitivity of the data it contains.

Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

• A.Central time servers receive time signals from specific, approved external sources.
• B.Each internal system peers directly with an external source to ensure accuracy of time updates.
• C.Access to time configuration settings is available to all users of the system.
• D.Each internal system is configured to be its own time server.

An internal NTP server that provides time services to the Cardholder Data Environment is?

• A.Not in scope for PCI DSS.
• B.In scope for PCI DSS.
• C.Only in scope if it provides time services to database servers.
• D.Only in scope if it stores, processes or transmits cardholder data.