Key Management Requirements:
* PCI DSS Requirement 3.5 specifies the protection of cryptographic keys, including encryption, storage in secure cryptographic devices (SCDs), or as key components to ensure security and prevent unauthorized access.
Clarifications on Cryptographic Key Protection:
* A/B:Public keys and key strength requirements are not specified in this context.
* D:Separation of duties mandates that key-encrypting and data-encrypting keys must not be assigned to the same custodian.
Testing and Validation:
* QSAs verify compliance by examining key management practices, storage mechanisms, and access controls for cryptographic keys during the assessment.

As specified underRequirement 11.5.2.1, comparisons of critical files (e.g., config files, executables) using change-detection mechanisms (e.g., FIM tools)must occur at least weekly. This ensures timely detection of unauthorized changes or tampering.
* Option A:#Correct. Weekly is theminimum frequencyrequired.
* Option B:#Incorrect. A defined "period" is not sufficient unless it's weekly or more frequent.
* Option C:#Incorrect. Scans should not wait for changes; they should detectunexpectedones.
* Option D:#Incorrect. Monthly is too infrequent for PCI DSS compliance.
Reference:PCI DSS v4.0.1 - Requirement 11.5.2.1.

PCI DSSRequirement 8.4.2requiresmulti-factor authentication (MFA)to consist of two or moreindependent authentication factors. MFA must alsonot involve shared credentials, so each certificate must be tied to a specific individual.
* Option A:#Incorrect. MFA must apply toall applicable users, not just admins.
* Option B:#Correct. This meets PCI DSS: unique credentials per user and non-shared certificates.
* Option C:#Incorrect. Retaining certificates post-employment is a risk, not a compliance action.
* Option D:#Incorrect. PCI DSS doesn't mandate 90-day certificate rotation; rather, secure usage and revocation are key.
Reference:PCI DSS v4.0.1 - Requirement 8.4.2 and 8.6.1.

Requirement 6.4.3.1clarifies that if live PANs are to be used in testing, the test environment mustmeet all applicable PCI DSS controls. Thus,testing with live PAN is only allowed if the test environment is within the CDEand fully secured.
* Option A:#Incorrect. Testing should not happen in production.
* Option B:#Incorrect. It must be within the CDE if live PAN is involved.
* Option C:#Correct. Live PANs can be used inpre-production environments within the CDE.
* Option D:#Incorrect. There's no requirement to test only within QSA environments.
Reference:PCI DSS v4.0.1 - Requirement 6.4.3.1 and its Applicability Note.

Sampling is a legitimate method under PCI DSS for assessing a representative subset of system components and locations.Section 6 - Sampling for PCI DSS Assessmentsoutlines thatsampling of business facilities and system componentsis allowed, as long as it's justified, consistent, and documented.
* Option A:Incorrect. PCI DSS requirements themselvescannotbe sampled.
* Option B:Incorrect.Compensating controls must be assessed in full, not sampled.
* Option C:Correct. Sampling may apply tobusiness facilities and system componentsto make the assessment more efficient.
* Option D:Incorrect.Policies and proceduresmust be evaluated in full.
Reference:PCI DSS v4.0.1 - Section 6: Sampling for PCI DSS Assessments.