QSA_New_V4 Qualified Security Assessor V4 Exam Question and Answers

ï‚· Attestation of Compliance (AOC):

The AOC is a document that confirms an entity’s compliance with PCI DSS requirements. It is signed by the entity (merchant or service provider) and the Qualified Security Assessor (QSA) if a QSA is involved.

ï‚· Different AOC Templates:

PCI DSS provides distinct templates for service providers and merchants, tailored to their respective roles and responsibilities within the cardholder data environment (CDE)​​.

ï‚· Invalid Options:

B:PCI SSC does not sign AOCs; they are signed by the merchant/service provider and the QSA.

C:AOCs differ between ROCs and SAQs, so the same template is not universally used.

D:Both the merchant/service provider and the QSA/ISA (Internal Security Assessor) must sign the AOC when applicable.

The strength of a key-encrypting key (KEK) should be at least equivalent to the strength of the data-encrypting key (DEK) it protects to ensure the overall security of the cryptographic system.​

Option A:Incorrect. DES (Data Encryption Standard) with a 256-bit key length is not a standard configuration, as traditional DES uses a 56-bit key, which is considered weak by modern standards.​

Option B:Incorrect. RSA with a 512-bit key length is considered weak and does not provide sufficient security for protecting AES 128-bit keys.​

Option C:Correct. Using an AES 128-bit key as the KEK to protect an AES 128-bit DEK ensures that both keys have equivalent strength, maintaining the integrity of the encryption system.​

Option D:Incorrect. ROT13 is a simple substitution cipher and does not provide adequate security for encrypting cryptographic keys.​

For detailed guidelines on cryptographic key management, refer toRequirement 3: Protect Stored Account Datain thePCI DSS v4.0.1document.​

Requirement 1.3.7andRequirement 3.3.1emphasise thatdatabases storing cardholder data must not be directly accessible from the Internet or untrusted networks. The database must be behind firewalls and accessible only via controlled, authorised connections.

Option A:❌Incorrect. Combining servers may violate the one-function-per-server rule (Requirement 2.2.1).

Option B:✅Correct. The database must be protected fromdirect public access.

Option C:❌Incorrect. Web servers often reside in the DMZ; moving them internally could increase risk.

Option D:❌Incorrect. Network performance is not a PCI DSS concern —security isolation is.

Requirement 6.4.3.1clarifies that if live PANs are to be used in testing, the test environment mustmeet all applicable PCI DSS controls. Thus,testing with live PAN is only allowed if the test environment is within the CDEand fully secured.

Option A:❌Incorrect. Testing should not happen in production.

Option B:❌Incorrect. It must be within the CDE if live PAN is involved.

Option C:✅Correct. Live PANs can be used inpre-production environments within the CDE.

Option D:❌Incorrect. There’s no requirement to test only within QSA environments.

ï‚· Compensating Controls Definition and Purpose

A compensating control is an alternate measure that satisfies the intent of a specific PCI DSS requirement and provides an equivalent level of security.

The rationale and risk mitigation must be explicitly documented using the Compensating Control Worksheet (CCW).

ï‚· Mandatory Documentation

PCI DSS v4.0 mandates the use of a CCW when implementing compensating controls. This applies regardless of acquirer approvals​​.

The CCW requires detailed documentation including:

Constraints preventing the original requirement from being implemented.

Justification for the compensating control.

Description of the control and evidence of its effectiveness.

ï‚· Using Existing Requirements

If an existing PCI DSS requirement (e.g., Requirement 5 for antivirus) is already implemented and can mitigate the risks of not meeting another requirement, it may qualify as a compensating control​​.

ï‚· Approval and Review Process

QSAs must validate the implementation, effectiveness, and appropriateness of compensating controls during the assessment process​

According toRequirement 12.10.1, an effectiveincident response plan (IRP)must include steps to detect, respond to, and contain incidents such asunauthorised wireless access points. PCI DSS11.2.1also mandates quarterly rogue AP detection.

Option A:❌Incorrect. Notification to PCI SSC is not required; notification goes toacquirers/payment brands.

Option B:✅Correct. The IRP must includeresponse to unauthorised wireless access detection.

Option C:❌Incorrect. Records must beretained, not deleted.

Option D:❌Incorrect. Retaliatory or offensive actions arenot allowed or recommended.

PCI DSSRequirement 12.8.4mandates that an entitymonitor the compliance status of third-party service providers (TPSPs) at least annually, especially when those TPSPs store, process, or transmit account data on the entity’s behalf.

Option A:Incorrect. Entities are not responsible for conducting ASV scans on TPSPs.

Option B:Incorrect. There is no quarterly risk assessment requirement for TPSPs.

Option C:Incorrect. Incident response testing for TPSPs is not a direct responsibility of the entity.

Option D:Correct. Annual monitoring of TPSP compliance is explicitly required.

Requirement 10.5.1.1requires thataudit logs be protected from unauthorised viewing and modification, and access should berestricted to individuals with a job-related need to view them. This principle aligns with least privilege and ensures accountability.

Option A:❌Incorrect. The person who performed the action may not need to view logs.

Option B:❌Incorrect. Read/write access istoo permissive.

Option C:❌Incorrect. Not all administrators need access to logs.

Option D:✅Correct. Access should bebased on job function.

PCI DSSRequirement 11.5.2mandates the use of file-integrity monitoring (FIM) or change-detection tools to monitorcritical filessuch as system binaries, configuration files, and system parameters.

Option A:❌Incorrect. Manuals are not critical system files.

Option B:❌Incorrect. Regularly changing files (e.g., logs or temp files) are typically excluded.

Option C:❌Incorrect. Policies and procedures are reviewed but not subject to FIM.

Option D:✅Correct. System config and parameter files must bemonitored for unauthorised changes.

PCI DSSRequirement 12.1.1requires that security policies and procedures be disseminated to all relevant personnel and that those individualsunderstand and acknowledgethe policies. While review and update frequencies are also part of compliance, the most complete and correct answer is that policies must be shared with affected parties.

Option A:Incorrect. Encryption is not specifically required for policy documents.

Option B:Incorrect. Limiting access to only management contradicts the requirement for distribution.

Option C:Incorrect. The correct review cycle per Requirement 12.1.2 isannually, not quarterly.

Option D:Correct. Policies and procedures must be understood and acknowledged by all affected parties.

ï‚· Definition of Quarterly:

PCI DSS defines "quarterly" as occurring once within each calendar quarter. This means the activity must happen at least once in Q1, Q2, Q3, and Q4, with no rigid restrictions on specific days​​.

ï‚· Clarification on Other Options:

B:While 95–97 days approximates a quarter, it is not mandated as a rigid timeframe.

C/D:Fixed dates (e.g., 15th or 1st of specific months) are not prescribed in PCI DSS.

ï‚· Visitor Management Requirements:

PCI DSS Requirement 9.3 specifies that visitors must be escorted at all times in areas where cardholder data is present to prevent unauthorized access or breaches​​.

ï‚· Invalid Options:

B:Visitor badges must be distinguishable from employee badges.

C:Visitor logs are necessary but do not need detailed personal information like addresses.

D:Retaining visitor identification for 30 days is not a requirement.

ï‚· Customized Approach Overview:

Under PCI DSS v4.0, entities can use a Customized Approach to meet requirements by implementing controls tailored to their environment. This allows flexibility while still achieving the intent of the security requirement.

ï‚· Role of Assessors:

Assessors (QSAs) are responsible for evaluating both the implementation of customized controls and ensuring these controls fulfill the security objectives of the PCI DSS requirements​​.

QSAs must document the evaluation, evidence reviewed, and results in the Report on Compliance (ROC).

ï‚· Controls Matrix and Targeted Risk Analysis (TRA):

The Controls Matrix and TRA are key components of the Customized Approach. QSAs assist in verifying the accuracy and completeness of these tools during assessments​​.

ï‚· Documenting in the ROC:

The ROC must include a narrative explaining the assessor’s findings regarding the customized control, validation methods, and any evidence collected​.

ï‚· Relevant PCI DSS v4.0 Guidance:

Appendix D and E of the PCI DSS v4.0 ROC Template emphasize that QSAs can evaluate and confirm adherence to the Customized Approach provided this is documented comprehensively in the ROC​.

ï‚· PCI PIN Transaction Security (PTS) Standard:

The PCI PTS standard focuses on securing Point-of-Interaction (POI) devices, such as payment terminals, that process payment card transactions and protect account data during capture​​.

ï‚· Clarifications on Covered Areas:

This standard includes specifications for physical and logical security controls to prevent unauthorized access to sensitive cardholder data on POI devices.

ï‚· Invalid Options:

B:Secure coding practices are addressed by PCI PA-DSS (Payment Application Data Security Standard).

C:Cryptographic algorithm development is not specific to PCI PTS.

D:End-to-end encryption solutions are not covered under PCI PTS.

UnderAppendix D – Customized Approach, it is clearly stated that theentity is responsiblefor completing theControls Matrixand theTargeted Risk Analysis (TRA). The assessor may assist in completion, but accountability for content lies with the entity.

Option A:Incorrect. QSAs may assist but are not solely responsible.

Option B:Incorrect. This overstates who is responsible; only the entity is ultimately accountable.

Option C:Correct. The entity being assessed is responsible for completing the Controls Matrix and TRA.

Option D:Incorrect. Card brands or acquirers are not involved in document creation.

PerRequirement 2.2.5, allinsecure and unnecessary services, protocols, daemons, or functionsmust be disabled. This includes unnecessary features on firewalls and other devices. Disabling unneeded functions reduces the attack surface and aligns with secure configuration principles.

Option A:❌Incorrect. Shared accounts violateRequirement 8.2.1, which mandatesunique IDs.

Option B:❌Incorrect. Allowing all traffic is a violation ofRequirement 1.2.1, which requires "deny all unless explicitly allowed".

Option C:❌Incorrect. Synchronizing rules may be useful but does not directly relate to hardening.

Option D:✅Correct. Disabling unused firewall features aligns with secure configuration.

ï‚· Scope of Change-Detection Mechanisms

PCI DSS v4.0 requires the implementation of a change-detection mechanism (e.g., file-integrity monitoring) to monitor unauthorized changes to critical files.

Critical files include system configuration and parameter files, application executable files, and scripts used in administrative functions​​.

ï‚· Intent of Monitoring System Files

These files often control security settings and operational parameters of systems within the Cardholder Data Environment (CDE). Unauthorized changes could compromise system security.

ï‚· Exclusions

Documents like application vendor manuals and security policies do not qualify as files requiring integrity monitoring since they do not directly impact the security posture or operational functions of systems in the CDE.

As perRequirement 2.2.1, the purpose of limiting each server to one primary function is toreduce the risk of functions with lower security needs compromising more critical functions.

Option A:❌Incorrect. PCI DSS discourages combining different security-level functions.

Option B:✅Correct. This is the intent: toprevent lower-security processes from weakening high-security environments.

Option C:❌Incorrect. Functions shouldn’t depend on one another for security.

Option D:❌Incorrect. PCI DSS encourages raising security, not lowering it.

Requirement9.9.2of PCI DSS v4.0.1 mandates that entitiesregularly inspect POS devicesto detect signs of tampering or skimming. This includes physical inspections to identify unexpected additions, unauthorized stickers, broken seals, etc.

Option A:Correct. Regular inspection for skimming/tampering is required.

Option B:Incorrect. There is no mandate for manufacturer serial number verification.

Option C:Incorrect. PCI DSS does not require routine replacement of device identifiers or labels.

Option D:Incorrect. Devices may be investigated if compromised, but not necessarily destroyed.