PCI DSS 3.2

How often should penetration tests be conducted for merchants?

• Every quarter

• Every 2 years

• Every year

• Every 6 months

A payment token is used for?

• Randomization of account data

• Collecting Payment card information in a centralized location

• End to end encryption

• Fraud detection

True or False --- The PCI SSC was created to have consistent fines and processes if a company is out of compliance.

• True

• False

All merchants levels are required to have

• Penetration Testing

• ASV scan

• Service Providers

• QSA Audits

What is the Attestation of Compliance (AOC) is

• A detailed document describing the CDE

• Used to train merchants on PCI

• Document from QSA certifying compliance

• Hundreds of pages long

The internal security assessor is used to

• Quality control of QSA documents

• Evaluate service providers

• Complete SAQ D

• Conduct internal audit of level 2 merchants

The goal of building and maintaining a secure environment has which requirements?

• Restrict physical access and require unique IDs

• Maintaining a security policy

• Frewalls and no default passwords

• strong encryption

True or False -- All users including customers are required to have a user account in the CDE

• True

• False

True of False --- Antivirus isn't required if you have other anti-malware solutions in place

• True

• False

How does an auditor collect information to determine compliance

• Interviews and artifacts

• scanning tools

• third party service providers

• Past assessments