お手軽に合格させる 最新PCI SSC Assessor_New_V4問題集には62問があります
最新のAssessor_New_V4学習ガイド2024年最新の- 提供するのはテストエンジンとPDF
質問 # 24
What is the intent of classifying media that contains cardholder data?
- A. Ensuring that media is property protected according to the sensitivity of the data it contains
- B. Ensuring that media containing cardholder data is moved from secured areas an a quarterly basis
- C. Ensuring that all media is consistently destroyed on the same schedule regardless of the contents
- D. Ensuring that media is clearly and visibly labeled as 'Confidential so all personnel know that the media contains cardholder data
正解：A
解説：
Explanation
classifying media that contains cardholder data is intended to ensure that media is property protected according to the sensitivity of the data it contains, which means it should be marked with labels or tags that indicate its level of confidentiality or integrity. This is one of the requirements for ensuring that media containing cardholder data is properly labeled.
質問 # 25
An entity wants to know if the Software Security Framework can be leveraged during their assessment Which of the following software types would this apply to?
- A. Validated Payment Applications that are listed by PCI SSC and have undergone a PA-DSS assessment
- B. Any payment software in the CDE
- C. Only software which runs on PCI PTS devices
- D. Software developed by the entity in accordance with the Secure SLC Standard
正解：D
解説：
Explanation
According to requirement 12.3.2, software developed by an entity in accordance with the Secure SLC Standard must be validated by a Qualified Security Assessor (QSA) before it can be used by an entity in its CDE. This is one of the requirements for ensuring that software developed by an entity in accordance with the Secure SLC Standard meets all the security standards and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1.
質問 # 26
Which of the following types of events is required to be logged?
- A. All network transmissions
- B. All access to external web sites
- C. All access to all audit trails
- D. All use of end-user messaging technologies
正解：C
解説：
Explanation
all network transmissions must be logged by an entity's security information and event management (SIEM) system or equivalent tool, which means they should record all network events and activities related to cardholder data processing and transmission. This is one of the requirements for ensuring that network transmissions are monitored and audited.
質問 # 27
Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?
- A. Access to time configuration settings is available to all users of the system.
- B. Each internal system peersdirectorywith an external source to ensure accuracy of time updates
- C. Central time servers receive time signals from specific, approved external sources
- D. Each internal system is configured to be its own time server.
正解：C
解説：
Explanation
critical systems must have correct and consistent time, which means they should use a reliable time source and synchronize their clocks with other systems. This is one of the requirements for ensuring that critical systems have accurate time.
質問 # 28
Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?
- A. A new key custodian must be assigned
- B. All data encrypted under the retired key must be securely destroyed
- C. The retired key must not be used for encryption operations
- D. Cryptographic key components from the retired key must be retained for 3 months before disposal
正解：B
解説：
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, all data encrypted under the retired key must be securely destroyed, which means it should be overwritten with random data or deleted from the storage device. This is one of the requirements for ensuring that data encryption keys are not reused or compromised.
質問 # 29
Which statement is true regarding the presence of both hashed and truncated versions ofthe same PAN in an environment?
- A. Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions
- B. The hashed and truncated versions must be correlated so the source PAN can be identified
- C. The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.
- D. Hashed and truncated versions of a PAN must not exist in same environment
正解：D
解説：
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, the hashed and truncated versions of the same PAN must not exist in the same environment, which means they should not be stored or transmitted together. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
質問 # 30
An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?
- A. Periodically as defined by the entity
- B. At least weekly
- C. Only after a valid change is installed
- D. At least monthly
正解：A
解説：
Explanation
critical file comparisons must be performed periodically as defined by the entity, which means they should be done at least once every 30 days or more frequently if needed. This is one of the requirements for ensuring that critical file comparisons are done regularly.
質問 # 31
Which of the following statements is true regarding track equivalent data on the chip of a payment card?
- A. It is sensitive authentication data
- B. It is out of scope for PCI DSS
- C. It is not applicable for PCI DSS Requirement 3.2
- D. It is allowed to be stored by merchants after authorization if encrypted
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, track equivalent data on the chip of a payment card is sensitive authentication data, which means it can be used to authenticate a cardholder or a transaction, but it should not be stored or transmitted by merchants after authorization if encrypted. This is one of the requirements for preventing unauthorized access to sensitive authentication data.
質問 # 32
an entity under assessment is using the customized approach, which of the following steps is the responsibility of the assessor?
- A. Derive testing procedures and document them in Appendix E of the ROC.
- B. Document and maintain evidence about each customized control as defined in Appendix E of PCI DSS
- C. Perform the targeted risk analysis as per PCI DSS requirement 12.3.2
- D. Monitor the control.
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor must derive testing procedures and document them in Appendix E of the ROC. This is one of the requirements for ensuring that testing procedures are defined and documented.
質問 # 33
According to the glossary, bespoke and custom software describes which type of software?
- A. Virtual payment terminals
- B. Any software developed by a third party
- C. Any software developed by a third party that can be customized by an entity.
- D. Software developed by an entity for the entity's own use
正解：D
解説：
Explanation
According to the glossary, bespoke and custom software describes software developed by an entity for its own use, which means it should not be shared with other entities or sold or transferred without proper authorization. This is one of the requirements for ensuring that bespoke and custom software meets all the security standards and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1.
質問 # 34
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)
- A. AES 128
- B. DES256
- C. ROT 13
- D. RSA512
正解：B
解説：
Explanation
when a cryptographic key is retired and replaced with a new key, the new key must have an appropriate strength for its intended use, which means it should have a sufficient length and complexity to resist brute-force attacks. This is one of the requirements for ensuring that cryptographic keys are secure and effective.
質問 # 35
Which of the following is a requirement for multi-tenant service providers?
- A. Provide customers with access to the hosting provider s system configuration files.
- B. Ensure that customers cannot access another entity s cardholder data environment
- C. Provide customers with a shared user ID for access to critical system binaries
- D. Ensure that a customer's log files are available to all hosted entities
正解：B
解説：
Explanation
According to requirement 3.1.2, multi-tenant service providers must ensure that customers cannot access another entity's cardholder data environment, which means they should isolate each customer's cardholder data from other customers' cardholder data and prevent unauthorized access or disclosure. This is one of the requirements for ensuring that multi-tenant service providers protect each customer's cardholder data.
質問 # 36
In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place''?
- A. Details of the entity s reason for not implementing the requirement
- B. Details of the entity s project plan for implementing the requirement
- C. Details of how the assessor observed the entity s systems were compliant with the requirement
- D. Details of how the assessor observed the entity s systems were not compliant with the requirement
正解：C
解説：
Explanation
when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity's systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.
質問 # 37
What do PCI DSS requirements for protecting cryptographic keys include?
- A. Data-encrypting keys must be stronger than the key-encrypting key that protects it.
- B. Private or secret keys must be encrypted, stored within an SCD or stored as key components
- C. Public keys must be encrypted with a key-encrypting key.
- D. Key-encrypting keys and data-encrypting keys must be assigned to the same key custodian
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, private or secret keys must be encrypted, stored within an SCD or stored as key components. This is one of the requirements for ensuring secure encryption and authentication.
質問 # 38
Which of the following parties is responsible for completion of the Controls Matrix to* the Customized Approach?
- A. Only a Qualified Security Assessor (QSA)
- B. Entity being assessed
- C. Card brands or acquirer
- D. EitheraQSA,AQSA,orPClP.
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, assigning a unique ID to each person is intended to ensure individual users are accountable for their own actions, rather than shared accounts or group accounts based on need-to-know. This is one of the requirements for ensuring that user accounts are properly managed and controlled.
質問 # 39
In accordance with PCI DSS Requirement 10. how long must audit logs be retained?
- A. At least 3 months with the most recent month immediately available
- B. At least 1 year, with the most recent 3 months immediately available
- C. At least 2 years, with the most recent 3 months immediately available
- D. At least 2 years with the most recent month immediately available
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, audit logs must be retained for at least 1 year, with the most recent 3 months immediately available. This is one of the requirements for ensuring that audit logs are available for review and analysis.
質問 # 40
An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?
- A. Change control processes are in place to ensue certificates are changed every 90 days
- B. A different certificate is assigned to each individual user account, and certificates are not shared
- C. Certificates are logged so they can be retrieved when the employee leaves the company
- D. Certificates are assigned only to administrative groups and not to regular users
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a different certificate is assigned to each individual user account, and certificates are not shared. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
質問 # 41
The intent of assigning a risk ranking to vulnerabilities is to?
- A. Replace the need toquarterly ASV scans
- B. Prioritize the highest risk items so they can be addressed more quickly
- C. Ensure that critical security patches are installed at least quarterly
- D. Ensure all vulnerabilities are addressed within 30 days
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the intent of assigning a risk ranking to vulnerabilities is to prioritize the highest risk items so they can be addressed more quickly, rather than ensuring all vulnerabilities are addressed within 30 days or replacing the need to quarterly ASV scans or ensuring that critical security patches are installed at least quarterly. This is one of the requirements for ensuring that vulnerabilities are identified and mitigated as soon as possible.
質問 # 42
Which statement about PAN is true?
- A. It must be protected with strong cryptography for transmission over private wireless networks
- B. It does not require protection for transmission over public wired networks
- C. It does not require protection for transmission over public wireless networks
- D. It must be protected with strong cryptography (or transmission over private wired networks
正解：A
解説：
Explanation
According to requirement 4, PAN must be protected with strong cryptography for transmission over private wireless networks, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception of cardholder data over wireless networks. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.
質問 # 43
What must be included m an organization's procedures for managing visitors9
- A. Visitors are escorted at all times within areas where cardholder data is processed or maintained
- B. Visitor badges are identical to badges used by onsite personnel
- C. Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit
- D. Visitor log includes visitor name, address, and contact phone number
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, visitors are escorted at all times within areas where cardholder data is processed or maintained, visitor badges are identical to badges used by onsite personnel, visitor log includes visitor name, address, and contact phone number, visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit. These are some examples of procedures that must be included in an organization's procedures for managing visitors who access in-scope systems where cardholder data is processed or maintained.
質問 # 44
......
Assessor_New_V4問題集と試験テストエンジン：https://jp.fast2test.com/Assessor_New_V4-premium-file.html