Associate Qualified Security Assessor (AQSA) Certification Practice Exam

These questions are part of the practice quiz. Start practicing

• Which coding vulnerability is characterized by allowing an attacker to execute arbitrary code on a system?
• What is the purpose of Requirement 6 in system security?
• Who are merchants required to report their compliance to?
• Which of the following is an important aspect of payment brand compliance?
• Requirement 10.7 deals with what aspect of logs?
• Which practice helps ensure security vulnerabilities are addressed within a timely manner?
• Which device is NOT typically involved in establishing network segmentation controls?
• What is required to identify and authenticate access to system components?
• What triggers a log event during access to cardholder data?
• Which action is considered a necessary part of maintaining an information security policy?
• What does Appendix A3 require?
• What is the maximum number of digits of a Primary Account Number (PAN) that can be displayed, according to requirement 3.3?
• What does Requirement 11.1 specifically require?
• What is meant by "protecting cardholder data during transmission"?
• When scoping an environment for PCI DSS, which of the following is NOT important to identify?
• Which method is recommended to meet the requirement of rendering PAN unreadable?
• Why is it important to interview all application, database, and system owners during an assessment?
• What is the primary focus of requirement 1 in PCI DSS?
• What role does audit logging play in security?
• Where should firewalls ideally be placed in a secure network?
• When does the authorization of a transaction typically take place?
• When is storing track data "long term" permitted?
• What does SAQ-B indicate for merchants?
• Which track contains all fields of Track 2 plus the cardholder's name and is up to 79 characters long?
• Which of the following requires authorization from management before altering?
• What is Goal 2 aimed at in a security context?
• What does requirement 3.1 emphasize regarding cardholder data?
• What role does the issuer play in the payment transaction?
• According to requirement 10.5, what must be done to audit trails?
• Which scenario meets the intent of PCI DSS requirements for assigning user access to cardholder data?
• What is a critical requirement for merchants transferring cardholder data via a website in the SAQ-C category?
• Who is responsible for the assignment of penalties or fees for non-compliance among the Payment Card Brands?
• Which aspect can significantly reduce risks associated with processing cardholder data?
• Does encrypting sensitive authentication data remove it from PCI DSS scope?
• What is a requirement established by the PCI Security Standards Council?
• Sensitive Authentication Data includes which of the following?
• Which of the following is a component that provides security in PCI DSS compliance?
• What action cannot the PCI SSC take against a PCIP who violates the PCI SSC Code of Professional Responsibility?
• A secure network should not expose what type of data?
• What is a key component addressed by PCI Security Standards?
• Who should have access to view the audit trail?
• SAQ-A-EP is applicable to which type of merchants?
• What does SAQ D represent?
• Which of the following is NOT included in the controls covered in requirement 2?
• What should organizations do when hiring third-party maintenance personnel for point-of-sale devices?
• What role does an acquirer play in the payment card transaction process?
• What does developing secure applications help protect against?
• What measures can be taken to ensure that PAN is unreadable when stored?
• Which entity sends payment transaction data through the payment network?
• According to requirement 3, which data is specifically noted for protection?
• Which of the following systems is commonly used to store track data?
• What is the purpose of a PCI DSS assessment?
• What defines a service provider according to PCI DSS?
• What is required for stateful firewalls regarding connections into the Cardholder Data Environment (CDE)?
• What is the Visa Europe Compliance Program known as?
• What should be done if vulnerabilities are discovered in a system?
• What should assessors consider when evaluating cardholder data security?
• What is the main focus of Requirement 10.8?
• What does the PCI Card Production standard ensure?
• What kind of vulnerabilities can arise from improper error handling in applications?
• Which of the following describes merchants in SAQ-B-IP?
• What is the main focus of Requirement 5 in security practices?
• Which statement is true regarding card verification codes according to requirement 3.2.2?
• What is Goal 3 related to in the context of security?
• What does sensitive authentication data include?
• Which of the following is NOT a required log information item?
• For compliance with PCI DSS, what is mandatory for third-party service providers?
• Insecure communications can lead to which type of vulnerability?
• Which statement is true regarding the use of PA-DSS validated applications?
• What is the main purpose of PCI PA-DSS?
• What type of data does the term "sensitive authentication data" encompass?
• Which companies are considered founding payment brands of PCI SSC?
• What is the minimum complexity of user passwords as defined in requirement 8?
• What is a major misconception about encrypted data in regard to PCI DSS assessments?
• Goal 4 in security management focuses on what aspect?
• Which role plays a critical part in the oversight of PCI DSS compliance?
• Which aspect does PCI PTS primarily address?
• What is a primary benefit of implementing strong access controls?
• What must secret and private keys used to encrypt a PAN be encrypted with?
• Who are included in the term 'contractors' as onsite personnel?
• What is the SAQ commonly referred to?
• What does the PCI DSS standard primarily cover?
• What does Requirement 1 of the PCI DSS entail?
• What constitutes sensitive authentication data according to security standards?
• What is the focus of SAQ-C for merchants?
• What is an acceptable truncation format for MasterCard PANs?
• What is the official name of the MasterCard Compliance Program?
• What does the acronym PAN stand for in a security context?
• Regular testing of security systems is highlighted in which requirement?
• What does Requirement 6.2 specify regarding security patches?
• In terms of data breaches, what role do stateful firewalls play?
• What is the primary role of the PCI SSC?
• Who defines merchants and service provider levels?
• Which organization finalizes the authorization approval process?
• Which of the following best describes 'point-to-point encryption' (P2PE)?
• Why is key management important in PCI P2PE solutions?
• What is the role of Card Production standards?
• What is the card verification code for VISA cards called?
• What is the focus of PCI P2PE standards?
• Which statement is true regarding track data?
• The Mod 10 formula doubles the values of alternate digits of the primary account number starting with which digit?
• What is the order of participants in the payment processing workflow?
• What must entities handling point-of-sale devices do concerning third-party maintenance personnel?
• What may partially outsourced E-commerce merchants using a third-party website for payment processing fill out?
• What does the PCI PTS HSM standard govern?
• What type of transaction can a cardholder make?
• What is the purpose of encrypting non-console administrator access to management interfaces?
• Are Information Supplements from the PCI SSC able to replace PCI DSS requirements?
• What is the name of the compliance program established by Visa Inc.?
• Who is responsible for ensuring that only those with a work-related need can access audit trails?
• What does SAQ-P2PE refer to?
• What is a common error that can affect the proper scoping of a PCI DSS assessment?
• According to security requirements, which service is considered secure for system operations?
• What is the name of the JCB Compliance Program?
• What is the best way for a merchant to reduce their scope in compliance?
• What is the minimum log retention period specified in requirement 10.7?
• What is one of the major responsibilities of payment brands?
• Which PCI standard is focused on securing physical devices that read cardholder data?
• What is the purpose of monitoring for unauthorized wireless access points?
• Which three processes are essential for providing a secure PIN?
• What is the requirement for merchants categorized as SAQ-A?
• What does 'cardholder data' refer to in a security context?
• How are service provider levels determined?
• What must entities do to ensure they comply with PCI DSS regarding personnel access?
• Which merchant category does not allow for electronic transmission of cardholder data?
• What must exist for a control to be marked as a compensating control?
• Which statement is true regarding storage of cardholder data?
• Entities processing payment card transactions through mobile devices can reduce risks by doing what?
• What is considered the fastest method to reduce the scope of the PCI DSS assessment?
• Which systems are commonly used to store track data?
• What component is essential for protecting cardholder data during transmission?
• Who is ultimately responsible for the protection of cardholder data and PCI DSS compliance programs?
• What is the primary requirement of dual control in security protocols?
• What is the primary role of acquirers in payment processing?
• What component is critical for securing cardholder data in transactions?
• What key benefit does network segmentation provide in a PCI DSS context?
• Which of the following is NOT included in cardholder data?
• What is the Discover Compliance Program officially called?
• When should compensating controls be reevaluated?
• What two elements make up account data?
• What is the purpose of using time-synchronization technology in a security context?
• What does requirement 10.4 call for?
• What does Appendix A1 specifically address?
• What must compensating controls do according to industry standards?
• Is sensitive authentication data found only in the magnetic stripe of payment cards?
• SAQ-C is not applicable to which payment channel?
• What type of risk management is established under Requirement 6.1?
• Which of the following is NOT considered media containing cardholder data?
• What does the term "split knowledge" refer to in the context of security measures?
• How many Continuing Professional Education (CPE) hours must a PCIP accumulate each year?
• Which PCI standard applies to a merchant using a validated PCI P2PE solution?
• What encryption technology should be used for non-console administrator access to web-based management interfaces?
• What distinguishes SAQ-C-VT from other merchant categorizations?
• What does the term 'sampling' refer to in the context of a PCI DSS assessment?
• Which of the following describes an issuer in the payment card industry?
• What is the focus of PCI DSS Requirement 4?
• Which logs need to be reviewed at least daily?
• Merchant levels are primarily defined by which factor?
• What is one way to render a Primary Account Number (PAN) unreadable?
• Which entity determines a merchant's transaction volume?
• What is typically included in scoping documentation?
• How frequently should firewall and router rule sets be reviewed according to compliance standards?
• Which of the following is NOT a responsibility under Requirement 5.2 for maintaining anti-virus mechanisms?
• What requirement is common among all SAQs mentioned?
• Which of the following is an example of a web application vulnerability?
• Who is the SAQ P2PE intended for?
• What type of assessment is SAQ-A EP?
• Which Self-Assessment Questionnaire (SAQ) should a merchant use if they accept payments via telephone and enter cardholder data on a webpage?
• How should encryption technology be implemented for cardholder data?
• What is one key element that ensures the effectiveness of cryptographic measures?
• Is sensitive authentication data required for recurring transactions?
• What must be done if cardholder data is compromised?
• If a suspected card account number passes the Mod 10 test, what does it indicate?
• How is non-console access defined?
• What is one of the main requirements for a PCIP in maintaining their qualification?
• In the context of PCI DSS, who is considered a merchant?
• What is Goal 1 of secure network and system management?
• In regard to track information from magnetic stripes, what does requirement 3.2.1 state?
• Which of the following is a method to achieve network segmentation?
• Which type of devices can be utilized to provide network segmentation controls?
• Typical locations where card verification values/code may be found include which of the following?
• In a PCI context, why are compensating controls important?
• To meet security requirements, what should be managed alongside the cryptography used?
• What is a key requirement regarding default system passwords according to security standards?
• What is a primary focus of the PCI PTS standard?
• What is a cardholder?
• Which of the following methods can be used to safeguard cardholder data during storage?
• According to acceptable formats, what is the requirement for truncating MasterCard account numbers?
• If personnel have access to cardholder data, what must be ensured?
• Which cardholder data element is permitted to be stored?
• Which type of organization is still required to follow the PCI DSS even if they process only encrypted cardholder data?
• What is the potential consequence of not allowing enough time for thorough system testing during an assessment?
• The cardholder data environment consists of what elements?
• Which of the following is a primary focus when maintaining a secure network?
• What is the main responsibility of payment brands regarding compliance programs?
• Requirement 11 emphasizes the importance of what activity?
• When must merchants conduct a risk assessment according to PCI DSS?
• What must organizations ensure about access to network devices and servers per requirement 2?
• What is the definition of a visitor in the context of access control?
• What should organizations do regarding inventory of system components as per requirement 2?
• SAQ-B-IP is primarily for merchants using what type of payment terminal?
• What is Requirement 7's directive regarding access to cardholder data?
• What is a primary focus of requirement 3 in security practices?
• Which of the following is NOT a component of sensitive authentication data?
• What is an example of a security measure intended to protect cardholder data?
• What type of devices does PCI PTS address in its security measures?
• What does requirement 3.2.3 specify about storing personal identification numbers (PINs)?
• What type of media is described as containing cardholder data?
• What activity occurs during the "settlement" step in the payment process?
• System components within a PCI DSS framework include which of the following?
• Which of the following is true regarding compensating controls?
• According to requirement 3.2, what action should be taken regarding sensitive authentication data after authorization?
• What is the focus of PCI PIN Security?
• Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?
• Which approach is NOT part of using strong cryptography to safeguard cardholder data during transmission?
• According to PCI DSS requirement 1.2, firewall and router configurations must restrict connections between which two entities?
• Which requirement focuses on limiting physical access to cardholder data?
• Appendix A2 pertains to which type of security protocol?
• What does requirement 10 emphasize?
• What is a significant risk that requirement 3 seeks to minimize?
• What is the main objective of Requirement 12?
• What must be verified by the assessor when testing the protection of cardholder data sent over the Internet?
• What is the SAQ-D for Merchants?
• What aspect of security does implementing access control measures mainly address?
• Which security component does Requirement 10.8 NOT include for reporting failures?
• Are virtualization technologies in a cardholder data environment included in scope for PCI DSS?
• Which entity is responsible for establishing validation requirements for PA-DSS applications?
• Under what circumstances can cardholder data be used in test environments?
• Who qualifies as onsite personnel according to security definitions?
• Which of the following statements about service providers is true?
• Requirement 3.3 emphasizes masking what type of data when displayed?