QUESTION 22
Entities involved in payment card processing via mobile devices (like a phone or tablet) can reduce the risks to the security of cardholder data by:

QUESTION 23
Use of a Qualified Integrator/Reeller (QIR):

QUESTION 24
Which of the following lists the correct “order” for the flow of a payment card transaction?

QUESTION 25
The P2PE Standard covers:

QUESTION 26
Develop and maintain secure systems and applications is the _________

QUESTION 27
Requirement 2.2.2 and 2.2.3 cover the use of secure services, protocols, and daemons as required for the function of a system. Which of the following is considered secure?

QUESTION 28
Merchants using P2PE solutions are still required to validate to PCI DSS

QUESTION 29
PCIPs are required to adhere to the Code of Professional Responsibility, which includes:

QUESTION 30
Who can perform quarterly external vulnerability scans meeting requirement 11.2.2?

QUESTION 31
Restrict access to cardholder data by business need-to-know

QUESTION 32
To whom is Self-Assessment Question naire (SAQ) A intended for?

QUESTION 33
Internal and external vulnerability scans should run at minimum on every __________ to meet requirement 11.2

QUESTION 34
Please select all possible disciplinary actions that may be applicable in case of violation of PCI Code of
Professional Responsibility

QUESTION 35
What are best practices for implementing PCI DSS into Business-as-Usual (BAU) Processes? (Select
ALL that apply)

QUESTION 36
Which of the following entities will ultimately approve a purchase?

QUESTION 37
According to Requirement 10.4 the use of Time synchronization like NTP should be implemented on all critical systems for acquiring, distributing, and storing time.

QUESTION 38
Merchants involved with only card-not-present transactions that are completely outsourced to a PCI DSS complaint service provider may be eligible to use?

QUESTION 39
Information Security Policies must be reviewed/updated _____________ to meet requirement 12.1.1

QUESTION 40
Risk assessments must be implemented in order to meet requirement 12.2. Please select all risk assessments methodologies that can be used in order to meet this requirement.

QUESTION 41
When masking the PAN what is the maximum number of digits allowed to be displayed

QUESTION 42
When evaluating “above and beyond” for compensating controls, an existing PCI DSS requirement MAY be considered as compensating controls if they are required for another area, but are not required for the item under review