Assessor_New_V4 Exam練習テスト2024年最新のAssessor_New_V4ストレスなしで合格させちゃう！
練習PCI Qualified Professionals Assessor_New_V4問題集オンライン試験練習テストと詳細な解説付き！
質問 # 25
In accordance with PCI DSS Requirement 10. how long must audit logs be retained?
- A. At least 1 year, with the most recent 3 months immediately available
- B. At least 3 months with the most recent month immediately available
- C. At least 2 years, with the most recent 3 months immediately available
- D. At least 2 years with the most recent month immediately available
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, audit logs must be retained for at least 1 year, with the most recent 3 months immediately available. This is one of the requirements for ensuring that audit logs are available for review and analysis.
質問 # 26
If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?
- A. Verify the segmentation controls allow only necessary traffic into the cardholder data environment.
- B. Verify the payment card brands have approved the segmentation
- C. Verify that approved devices and applications are used for the segmentation controls
- D. Verify the controls used for segmentation are configured properly and functioning as intended
正解：A
解説：
Explanation
According to requirement 3.1.2, if segmentation is being used to reduce the scope of a PCI DSS assessment, the assessor will verify that the segmentation controls allow only necessary traffic into the cardholder data environment, which means they should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.
質問 # 27
Which scenario meets PCI DSS requirements for restricting access to databases containing cardholder data?
- A. User access to the database is only through programmatic methods
- B. User access to the database is restricted to system and network administrators
- C. Direct queries to the database are restricted to shared database administrator accounts
- D. Application IDs for database applications can only be used by database administrators
正解：D
解説：
Explanation
application IDs for database applications can only be used by database administrators, which means they should have access to all database applications and their settings. This is one of the requirements for ensuring that database administrators have full control over database applications.
質問 # 28
A retail merchant has a server room containing systems that store encrypted PAN data. The merchant has implemented a badge access-control system that identities who entered and exited the room on what date and at what time There are no video cameras located in the server room Based on this information, which statement is true regarding PCI DSS physical security requirements?
- A. The badge access-control system must be protected from tampering or disabling
- B. The merchant must install video cameras in addition to the existing access-control system
- C. Data from the access-control system must be securely deleted on a monthly basis
- D. The merchant must install motion-sensing alarms in addition to the existing access-control system
正解：A
解説：
Explanation
PCI DSS Requirement 9.1.1 requires entities to use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment (CDE)1. A badge access-control system is one example of such a control, as it can identify who entered and exited the server room and when. However, this control is only effective if it is protected from tampering or disabling by unauthorized persons, as PCI DSS Requirement 9.1.2 states1. Otherwise, the access-control system could be bypassed or compromised, allowing unauthorized access to the systems that store encrypted PAN data. Therefore, the badge access-control system must be protected from tampering or disabling, as stated in option A.
The other options are not true regarding PCI DSS physical security requirements for a server room. Option B is not true because PCI DSS does not mandate the use of video cameras in addition to the existing access-control system, although it is a recommended best practice2. Option C is not true because PCI DSS does not specify a data retention period for the access-control system, although it requires entities to retain audit trail history for at least one year, with a minimum of three months immediately available for analysis3. Option D is not true because PCI DSS does not require the use of motion-sensing alarms in addition to the existing access-control system, although it is another recommended best practice2. References:
PCI DSS v3.2.1
PCI DSS Requirement 9: Upping Your Physical Security
PCI DSS Requirement 10: Track and Monitor All Access to Network Resources and Cardholder Data
質問 # 29
an entity under assessment is using the customized approach, which of the following steps is the responsibility of the assessor?
- A. Monitor the control.
- B. Derive testing procedures and document them in Appendix E of the ROC.
- C. Document and maintain evidence about each customized control as defined in Appendix E of PCI DSS
- D. Perform the targeted risk analysis as per PCI DSS requirement 12.3.2
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor must derive testing procedures and document them in Appendix E of the ROC. This is one of the requirements for ensuring that testing procedures are defined and documented.
質問 # 30
At which step in the payment transaction process does the merchants bank pay the merchant for the purchase and the cardholder s bank bill the cardholder?
- A. Settlement
- B. Clearing
- C. Chargeback
- D. Authorization
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, settlement occurs when a merchant receives payment from a card issuer for a completed transaction and delivers goods or services to a customer or another party as agreed upon in advance by both parties, subject to any conditions imposed by either party upon delivery or payment, including but not limited to acceptance, rejection, return, exchange, refund, cancellation, modification, suspension, termination or revocation by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment; or any other conditions imposed by either party upon delivery or payment;
質問 # 31
If an entity shares cardholder data with a TPSP, what activity is the entity required to perform'?
- A. The entity must conduct ASV scans on the TPSP's systems at least annually
- B. The entity must test the TPSP's incident response plan at least quarterly
- C. The entity must perform a risk assessment of the TPSP's environment at least quarterly.
- D. The entity must monitor the TPSP's PCI DSS compliance status at least annually
正解：D
解説：
Explanation
According to requirement 4, an entity must monitor its TPSP's PCI DSS compliance status at least annually, which means it should review its TPSP's policies and procedures for protecting cardholder data and transactions against fraud and other threats at least once a year. This is one of the requirements for ensuring that an entity monitors its TPSP's PCI DSS compliance status regularly.
質問 # 32
Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?
- A. A network configuration that prevents all network traffic between the CDE and out-of-scope networks
- B. Firewalls that log all network traffic flows between the CDE and out of-scope networks
- C. Routers that monitor network traffic flows between the CDE and out-of-scope networks
- D. Virtual LANs that route network traffic between the CDE and out-of-scope networks
正解：D
解説：
Explanation
Segmentation is a method of isolating system components that store, process, or transmit cardholder data from systems that do not, by using security controls such as firewalls, routers, switches, or other devices1. Segmentation can reduce the scope of the cardholder data environment (CDE) and thus reduce the scope of the PCI DSS assessment, as only the systems and networks within the CDE or connected to the CDE are subject to PCI DSS requirements2. Virtual LANs (VLANs) are one example of such a security control, as they can create logical subnetworks that separate different types of traffic and restrict access between them3.
Therefore, the correct answer is option C.
The other options are not true regarding the scenario that describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope. Option A is not true because routers that monitor network traffic flows between the CDE and out-of-scope networks are not sufficient to isolate the CDE, as they do not prevent or limit the traffic flows. Option B is not true because firewalls that log all network traffic flows between the CDE and out-of-scope networks are not sufficient to isolate the CDE, as they do not block or filter the traffic flows. Option D is not true because a network configuration that prevents all network traffic between the CDE and out-of-scope networks is not realistic or feasible, as some traffic may be necessary for business or legal reasons, such as payment processing, reporting, or auditing. References:
Network Segmentation - PCI Security Standards Council
Guidance for PCI DSS Scoping and Network Segmentation
VLANs and PCI Compliance: What You Need to Know
質問 # 33
Assigning a unique ID to each person is intended to ensure?
- A. Individual users are accountable for their own actions
- B. Access is assigned to group accounts based on need-to-know
- C. Strong passwords are used for each user account
- D. Shared accounts are only used by administrators
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, individual users are accountable for their own actions, which means they should use strong passwords, change them regularly, and not share them with anyone else. This is one of the requirements for ensuring that user accounts are properly managed and controlled.
質問 # 34
Which of the following describes the intent of installing one primary function per server?
- A. To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server - B. To allow higher-security functions to protect lower-security functions installed on the same server
- C. To allow functions with different security levels to be implemented on the same server
- D. To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, installing one primary function per server is intended to prevent server functions with a lower security level from introducing security weaknesses to higher-security functions on the same server. This is one of the requirements for ensuring that server functions are isolated from each other.
質問 # 35
What must be included m an organization's procedures for managing visitors?
- A. Visitor badges are identical to badges used by onsite personnel
- B. Visitors are escorted at all times within areas where cardholder data is processed or maintained
- C. Visitor log includes visitor name, address, and contact phone number
- D. Visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, visitors are escorted at all times within areas where cardholder data is processed or maintained, visitor badges are identical to badges used by onsite personnel, visitor log includes visitor name, address, and contact phone number, visitors retain their identification (for example a visitor badge) for 30 days after completion of the visit. These are some examples of procedures that must be included in an organization's procedures for managing visitors who access in-scope systems where cardholder data is processed or maintained.
質問 # 36
Which of the following is true regarding internal vulnerability scans?
- A. They must be performed after a significant change
- B. They must be performed by QSA personnel
- C. They must be performed at least annually
- D. They must be performed by an Approved Scanning Vendor (ASV)
正解：A
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, internal vulnerability scans must be performed after a significant change in any component or configuration that affects cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.
質問 # 37
What process is requited by PCI DSS for protecting card-reading devices at the point-of-sale?
- A. The serial number of each device is periodically verified with the device manufacturer
- B. Devices are periodically inspected to detect unauthorized card stammers.
- C. Device identifiers and security labels are periodically replaced
- D. Devices are physically destroyed if there is suspicion of compromise
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, devices are periodically inspected to detect unauthorized card stammers using physical inspection or other methods such as software-based tools or network-based tools (such as firewalls). This is one of the requirements for preventing card skimming attacks that could compromise cardholder data.
質問 # 38
The intent of assigning a risk ranking to vulnerabilities is to?
- A. Ensure that critical security patches are installed at least quarterly
- B. Prioritize the highest risk items so they can be addressed more quickly
- C. Ensure all vulnerabilities are addressed within 30 days
- D. Replace the need toquarterly ASV scans
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the intent of assigning a risk ranking to vulnerabilities is to prioritize the highest risk items so they can be addressed more quickly, rather than ensuring all vulnerabilities are addressed within 30 days or replacing the need to quarterly ASV scans or ensuring that critical security patches are installed at least quarterly. This is one of the requirements for ensuring that vulnerabilities are identified and mitigated as soon as possible.
質問 # 39
Which of the following meets the definition of 'quarterly' as indicated in the description of timeframes used in PCI DSS requirements?
- A. On the 1st of each fourth month
- B. At least once every 95 97 days.
- C. Occurring at some point in each quarter of a year
- D. On the 15th of each third month
正解：D
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, quarterly means occurring at some point in each quarter of a year, not at least once every 95 or 97 days. This is one of the requirements for ensuring that PCI DSS assessments are conducted on a regular basis.
質問 # 40
An organization wishes to implement multi-factor authentication for remote access, using the user's individual password and a digital certificate. Which of the following scenarios would meet PCI DSS requirements for multi-factor authentication?
- A. Certificates are assigned only to administrative groups and not to regular users
- B. A different certificate is assigned to each individual user account, and certificates are not shared
- C. Certificates are logged so they can be retrieved when the employee leaves the company
- D. Change control processes are in place to ensue certificates are changed every 90 days
正解：B
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a different certificate is assigned to each individual user account, and certificates are not shared. This is one of the requirements for preventing unauthorized access to cardholder data using digital certificates.
質問 # 41
Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?
- A. A new key custodian must be assigned
- B. All data encrypted under the retired key must be securely destroyed
- C. Cryptographic key components from the retired key must be retained for 3 months before disposal
- D. The retired key must not be used for encryption operations
正解：D
解説：
Explanation
PCI DSS Requirement 3.6.4 states that entities must retire or replace keys when the keys have reached the end of their cryptoperiod, which is the time span during which a specific key can be used for cryptographic operations1. The retired key must not be used for encryption operations, as it may have been compromised or weakened by cryptanalysis, and may not provide adequate protection for the data. The retired key may still be used for decryption operations, if needed, to access historical data that was encrypted under the retired key2.
Therefore, the correct answer is option A.
The other options are not true regarding the cryptographic key retirement and replacement. Option B is not true because PCI DSS does not specify a retention period for the cryptographic key components from the retired key, although it requires entities to securely delete cryptographic material when it is no longer needed for business or legal reasons1. Option C is not true because PCI DSS does not require a new key custodian tobe assigned, although it requires entities to define and document the roles, responsibilities, and accountability of all key custodians1. Option D is not true because PCI DSS does not require all data encrypted under the retired key to be securely destroyed, although it requires entities to render cardholder data unreadable when it is no longer needed for business or legal reasons1. References:
PCI DSS v3.2.1
Cryptographic Key Blocks - PCI Security Standards Council
質問 # 42
What should the assessor verify when testing that cardholder data is protected whenever it is sent over open public networks?
- A. The security protocol accepts connections from systems with lower encryption strength than required by the protocol
- B. A proprietary security protocol is used
- C. The security protocol accepts only trusted keys
- D. The security protocol is configured to accept all digital certificates
正解：C
解説：
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the security protocol accepts only trusted keys.
This is one of the requirements for ensuring secure encryption and authentication.
質問 # 43
Which of the following is a requirement for multi-tenant service providers?
- A. Provide customers with access to the hosting provider s system configuration files.
- B. Ensure that a customer's log files are available to all hosted entities
- C. Ensure that customers cannot access another entity s cardholder data environment
- D. Provide customers with a shared user ID for access to critical system binaries
正解：C
解説：
Explanation
According to requirement 3.1.2, multi-tenant service providers must ensure that customers cannot access another entity's cardholder data environment, which means they should isolate each customer's cardholder data from other customers' cardholder data and prevent unauthorized access or disclosure. This is one of the requirements for ensuring that multi-tenant service providers protect each customer's cardholder data.
質問 # 44
A sample of business facilities is reviewed during the PCI DSS assessment What is the assessor required to validate about the sample?
- A. Every facility where cardholder data is stored is reviewed
- B. It includes a consistent set of facilities that are reviewed for all assessments.
- C. The number of facilities in the sample is at least 10 percent of the total number of facilities
- D. All types and locations of facilities are represented
正解：B
解説：
Explanation
when a sample of business facilities is reviewed during a PCI DSS assessment, the assessor will verify that it includes a consistent set of facilities that are reviewed for all assessments, which means it should cover all types and locations of facilities where cardholder data is stored. This is one of the requirements for ensuring that all facilities are reviewed.
質問 # 45
An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?
- A. At least monthly
- B. Only after a valid change is installed
- C. At least weekly
- D. Periodically as defined by the entity
正解：C
解説：
Explanation
PCI DSS Requirement 11.5 states that entities must deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly1. This is to ensure that any unauthorized or malicious changes to the files are detected and reported in a timely manner, and that the integrity and security of the files are maintained. Critical files are those that affect the security of the cardholder data environment (CDE), such as system files, application executables, configuration files, database files, and log files2. Therefore, the correct answer is option A.
The other options are not true regarding the frequency of critical file comparisons for a change-detection mechanism. Option B is not true because PCI DSS does not allow the entity to define the periodicity of the file comparisons, as it specifies a minimum frequency of at least weekly1. Option C is not true because PCI DSS does not limit the file comparisons to only after a valid change is installed, as it requires the file comparisons to be performed at least weekly regardless of the change status1. Option D is not true because PCI DSS does not allow the file comparisons to be performed at least monthly, as it requires a higher frequency of at least weekly1. References:
PCI DSS v3.2.1
File Integrity Monitoring Tools For PCI DSS
質問 # 46
......
最適なAssessor_New_V4試験学習資料と準備材料を提供しています：https://jp.fast2test.com/Assessor_New_V4-premium-file.html