According toRequirement 9.4.2.2, visitors must beescorted at all timesin areas where cardholder data is stored or processed. This is a key component of physical access control and is intended to prevent unauthorised access or tampering.
* Option A:#Correct. Escorts aremandatoryfor visitors in sensitive areas.
* Option B:#Incorrect. Visitor badgesmust be distinguishablefrom employee badges.
* Option C:#Incorrect. PCI DSS requires name and firm represented, butnot full address or phone.
* Option D:#Incorrect. Visitor badges must besurrendered or deactivatedimmediately after the visit ends.
References:
PCI DSS v4.0.1 - Requirements 9.4.2.1 to 9.4.2.3.

Requirement9.9.2of PCI DSS v4.0.1 mandates that entitiesregularly inspect POS devicesto detect signs of tampering or skimming. This includes physical inspections to identify unexpected additions, unauthorized stickers, broken seals, etc.
* Option A:Correct. Regular inspection for skimming/tampering is required.
* Option B:Incorrect. There is no mandate for manufacturer serial number verification.
* Option C:Incorrect. PCI DSS does not require routine replacement of device identifiers or labels.
* Option D:Incorrect. Devices may be investigated if compromised, but not necessarily destroyed.
Reference:PCI DSS v4.0.1 - Requirement 9.9.2.

The strength of a key-encrypting key (KEK) should be at least equivalent to the strength of the data- encrypting key (DEK) it protects to ensure the overall security of the cryptographic system.
* Option A:Incorrect. DES (Data Encryption Standard) with a 256-bit key length is not a standard configuration, as traditional DES uses a 56-bit key, which is considered weak by modern standards.
* Option B:Incorrect. RSA with a 512-bit key length is considered weak and does not provide sufficient security for protecting AES 128-bit keys.
* Option C:Correct. Using an AES 128-bit key as the KEK to protect an AES 128-bit DEK ensures that both keys have equivalent strength, maintaining the integrity of the encryption system.
* Option D:Incorrect. ROT13 is a simple substitution cipher and does not provide adequate security for encrypting cryptographic keys.
For detailed guidelines on cryptographic key management, refer toRequirement 3: Protect Stored Account Datain thePCI DSS v4.0.1document.

Internal vulnerability scanning is addressed underRequirement 11.3.1. According to PCI DSS, internal vulnerability scansmust be conducted at least once every three monthsandafter any significant changein the environment, such as new system components, changes in network topology, firewall rule changes, or product upgrades.
* Option A:Correct. Scans must be performed after significant changes.
* Option B:Incorrect. Internal scansdo not require an ASV. ASVs are required for external vulnerability scans (Requirement 11.3.2).
* Option C:Incorrect. A QSA is not required to perform internal scans. They can be performed by qualified internal staff or third-party providers.
* Option D:Incorrect. Internal scans arerequired quarterly, not annually.
Reference:PCI DSS v4.0.1 - Requirement 11.3.1.1.

Requirement10.2.2mandates that all access to audit trails must be logged. This ensures that any tampering, viewing, or deletion of audit data is traceable. It supports the broader goal of maintaining audit trail integrity and accountability.
* Option A:Incorrect. PCI DSS does not require logging use of end-user messaging.
* Option B:Incorrect. There's no explicit requirement to log access to external websites.
* Option C:Correct. PCI DSS mandates loggingall access to audit trailsto detect and respond to unauthorised attempts.
* Option D:Incorrect. Logging all network transmissions is not feasible and not required.
Reference:PCI DSS v4.0.1 - Requirement 10.2.2.