Qualified Security Assessor V4 Exam - QSA_New

Question 1

Which of the following statements is true whenever a cryptographic key is retired and replaced with a new key?

A. Cryptographic key components from the retired key must be retained for 3 months before disposal.

B. The retired key must not be used for encryption operations.

C. All data encrypted under the retired key must be securely destroyed.

D. A new key custodian must be assigned.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An entity accepts e-commerce payment card transactions and stores account data in a database. The database server and the web server are both accessible from the Internet. The database server and the web server are on separate physical servers. What is required for the entity to meet PCI DSS requirements?

A. The web server should be moved into the internal network.

B. The web server and the database server should be installed on the same physical server.

C. The database server should be moved to a separate segment from the web server to allow for more concurrent connections.

D. The database server should be relocated so that it is not accessible from untrusted networks.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

An entity is using custom software in their CDE. The custom software was developed using processes that were assessed by a Secure Software Lifecycle assessor and found to be fully compliant with the Secure SLC standard. What impact will this have on the entity's PCI DSS assessment?

A. There is no impact to the entity.

B. The custom software can be excluded from the PCI DSS assessment.

C. It automatically makes an entity PCI DSS compliant.

D. It may help the entity to meet several requirements in Requirement 6.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which statement about PAN is true?

A. It does not require protection for transmission over public wired networks.

B. It must be protected with strong cryptography for transmission over private wired networks.

C. It must be protected with strong cryptography for transmission over private wireless networks.

D. It does not require protection for transmission over public wireless networks.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Which of the following is an example of multi-factor authentication?

A. A token that must be presented twice during the login process.

B. A user password and a PIN-activated smart card.

C. A user fingerprint and a user thumbprint.

D. A user passphrase and an application-level password.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

An organization has implemented a change-detection mechanism on their systems. How often must critical file comparisons be performed?

A. Only after a valid change is installed

B. Periodically as defined by the entity

C. At least weekly

D. At least monthly

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

In the ROC Reporting Template, which of the following is the best approach for a response where the requirement was "In Place"?

A. Details of how the assessor observed the entity's systems were not compliant with the requirement.

B. Details of the entity's project plan for implementing the requirement.

C. Details of how the assessor observed the entity's systems were compliant with the requirement.

D. Details of the entity's reason for not implementing the requirement.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

What must be included in an organization's procedures for managing visitors?

A. Visitors retain their identification (for example, a visitor badge) for 30 days after completion of the visit.

B. Visitor badges are identical to badges used by onsite personnel.

C. Visitors are escorted at all times within areas where cardholder data is processed or maintained.

D. Visitor log includes visitor name, address, and contact phone number.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

PCI SSC Qualified Security Assessor V4 - QSA_New_V4 Exam Practice Test

Latest Update

Useful Links

Contact Us