Pass CPSA Exam to Get PCI Certification

Page 1 of 2

1. Which of the following must every assessor do to maintain their CPSA certification?

Complete annual requalification training or complete 3 assessments for different facilities each year

Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years

Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)

Submit evidence of internal training in a relevant area (as per the QRs)

2. An assessor is unsure if log review and interview is sufficient testing for a requirement.

Who can best answer this question?

Payment brands

Issuing banks

Vendor

PCI SSC

3. 1.A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

PCI SSC

Assessor

Issuing banks

Payment brands

4. Which of the following principles must be enforce by the HSA Access Control system?

Dual control

Dual presence

Dual control and dual presence

Dual guard entry when required

5. Where can misprinted, partially finished cards be shredded?

In any HSA room approved by the security manager

Either in the HSA printing room or destruction room

Only in the HSA destruction room

Either in the HSA destruction room or a loading bay that meets all requirements of a destruction room

6. You are driving to a vendor for their first assessment. The facility is in a rural area, twenty miles away from the nearest large town.

What most concerns you about the location?

The local fire service may not be able to reach the facility within 15 minutes

Law enforcement services may not be able to reach the facility in a timely manner

Power blackouts may affect security systems

There may not be adequate retail outlets, which may cause problems when sourcing lunch items for onsite personnel

7. A vendor puts cardholder information into a chip by sliding a payment card through a machine that programs it and verifies the data. The chip can make contactless

transactions.

Which of the following best describes the vendor’s activity?

Card personalization

Host Card Emulation (HCE) provisioning

Secure Element (SE) provisioning

Fulfillment

8. In which of the following locations must the CCTV and access control servers be located?

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

Within the secure server room inside of the HSA

9. How frequently must alarms on external doors of a card production and provisioning vendor environment be tested?

Every day

Every week

Every month

Every 3 months

10. Before you go on-site, the vendor’s primary contact communicates a legitimate reason for delaying the assessment for several months.

Who can approve the change in the report delivery schedule?

Vendor senior management

Payment brands

Affected issuers

PCI SSC

Page 2 of 2

11. In relation to guards, which of the following must the vendor ensure?

A clear segregation of duties is maintained between production staff and guards

A clear segregation of duties is maintained between guard and reception related job functions

There is always at least one guard on-site, including outside of working hours, to monitor security systems and premises

There is always at least one guard in the HSA and one guard in the security control room at all times

12. Which of these are guards allowed access to?

HSAs

Audit logs

Loading bays

Physical master keys that provide access to card production or provisioning areas

13. If you have a query about a missing field in the card production reporting template, which organization is best-placed to answer it?

The payment brands

The vendor

The issuer

PCI SSC

14. If a vendor plans to terminate an employee, which of these must be done?

The employee must be escorted from the premises immediately

The employee's locker and desk must be searched prior to termination

The Human Resources department must be notified prior to termination

The security manager must be notified in writing prior to termination

15. During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously.

You note this as non-compliant, why?

Employee information, including background checks, must be stored for at least seven years

Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

The vendor must retain the background information for at least 18 months after termination of contract

The vendor must only retain background information for all current employees, not for those that have been terminated

[email protected]

Mon - Sat 9:00am - 6:00pm

Pass CPSA Exam to Get PCI Certification

Related

Posts

About Us

EMAIL

Services

Opening Hours