Scope of Change-Detection Mechanisms
* PCI DSS v4.0 requires the implementation of a change-detection mechanism (e.g., file-integrity monitoring) to monitor unauthorized changes to critical files.
* Critical files include system configuration and parameter files, application executable files, and scripts used in administrative functions.
Intent of Monitoring System Files
* These files often control security settings and operational parameters of systems within the Cardholder Data Environment (CDE). Unauthorized changes could compromise system security.
Exclusions
* Documents like application vendor manuals and security policies do not qualify as files requiring integrity monitoring since they do not directly impact the security posture or operational functions of systems in the CDE.

ThePCI PIN Transaction Security (PTS)standard applies topoint-of-interaction (POI) hardware devices, such as PIN entry devices and POS terminals. It ensures these devicessecurely capture and process account data, particularly for PIN-based transactions.
* Option A:#Correct. PCI PTS focuses onhardware devicesthat process PIN or card data.
* Option B:#Incorrect. This is covered under theSecure Software Standard(part of the Software Security Framework).
* Option C:#Incorrect. Algorithm development is outside PCI SSC's scope.
* Option D:#Incorrect. End-to-end encryption is covered in other guidance (e.g., P2PE), not PTS.
References:
PCI SSC Website - PTS Overview
PCI DSS v4.0.1 - Section 3 references PTS when discussing secure devices.

PerRequirement 7.2.5and8.2.2, PCI DSS recommends thatonly application-layer accessbe allowed to databases storing cardholder data, preventing users from issuing direct SQL queries or accessing the database via administrative tools.
* Option A:#Correct. Restricting database access toprogrammatic (application-layer) methodsis strongly preferred and aligns with PCI DSS guidance.
* Option B:#Incorrect. Admins should not have unrestricted access unless justified and monitored.
* Option C:#Incorrect. Application IDs must not be used interactively by individuals (Requirement 8.6.1).
* Option D:#Incorrect. Shared accounts are disallowed (Requirement 8.2.1).
References:
PCI DSS v4.0.1 - Requirements 7.2.5, 8.2.1, 8.6.1.

According toPCI DSS Scope Definitions (Section 4.2.1), any system thatcan impact the security of the CDEisin scope, even if it doesn't store cardholder data. An LDAP server providing authentication to systems in the CDEdirectly affects access control, so it'sin scope.
* Option A:#Correct. Systems providingauthentication services to the CDEarein scope.
* Option B:#Incorrect. LDAP does not need to store card data to be in scope.
* Option C:#Incorrect. Influence over access security makes it in scope regardless of data processing.
* Option D:#Incorrect. Scope isn't limited to DMZ-linked systems.
Reference:PCI DSS v4.0.1 - Section 4.2.1 (System Components In Scope).

Requirement 4.2.1.1states that PAN must beprotected with strong cryptographywhenever transmitted overopen or public networks, includingprivate wirelesswhere security is not assured. While not allprivate wired networksrequire encryption,wirelessis generally considered untrusted.
* Option A:#Correct. PAN must be encrypted overprivate wireless networksdue to potential interception risks.
* Option B:#Incorrect. Privatewirednetworks typically don't require encryption unless they're untrusted.
* Option C & D:#Incorrect. PANalways requires protectionover public networks.
Reference:PCI DSS v4.0.1 - Requirement 4.2.1.1.