QSA_New_V4 Qualified Security Assessor V4 Exam Questions and Answers

Scope definition in PCI DSS v4.0.1 (Section 4)includesany system that can impact the security of the CDE. Time synchronization servers such asNTParecritical to log integrity(Requirement 10.6), and if they provide services to CDE systems,they are in scopeeven if they do not directly process cardholder data.

Option A:❌Incorrect. Scope is broader than just databases.

Option B:❌Incorrect. Time serversimpact log security, so they are in scope.

Option C:❌Incorrect. PCI DSS scope includes systems thataffect the securityof CDE, not just those storing card data.

Option D:✅Correct. Internal NTP servers providing services to the CDE arein scope.

PerSection 6 – Sampling for PCI DSS Assessments, the assessor must ensure the sample of business facilitiesincludes all types and locations, reflecting different operational environments. The goal is to cover variations that might affect compliance, such as data centers vs. call centers, or regional differences.

Option A:Incorrect. Each assessment may require a different sample depending on the environment.

Option B:Incorrect. There is no fixed 10% requirement for facility sampling.

Option C:Incorrect. A full review of every facility isn't required if representative sampling is used appropriately.

Option D:Correct. The samplingmust include all types and locationsof facilities to be valid.

Requirement 6.4.3.1clarifies that if live PANs are to be used in testing, the test environment mustmeet all applicable PCI DSS controls. Thus,testing with live PAN is only allowed if the test environment is within the CDEand fully secured.

Option A:❌Incorrect. Testing should not happen in production.

Option B:❌Incorrect. It must be within the CDE if live PAN is involved.

Option C:✅Correct. Live PANs can be used inpre-production environments within the CDE.

Option D:❌Incorrect. There’s no requirement to test only within QSA environments.

 Visitor Management Requirements:

PCI DSS Requirement 9.3 specifies that visitors must be escorted at all times in areas where cardholder data is present to prevent unauthorized access or breaches​​.

 Invalid Options:

B:Visitor badges must be distinguishable from employee badges.

C:Visitor logs are necessary but do not need detailed personal information like addresses.

D:Retaining visitor identification for 30 days is not a requirement.

Formulti-tenant service providers,isolation and segmentationare critical. As perRequirement 12.10.3, each customer’s environment must besegregated and protectedsuch that no tenant can access another’s data or systems.

Option A:✅Correct. This is the foundational control —isolation of customer environments.

Option B:❌Incorrect. Exposing system config files is a security risk.

Option C:❌Incorrect. Shared user IDs areexplicitly prohibitedby Requirement 8.2.1.

Option D:❌Incorrect. Customers should only access their own logs.

 Attestation of Compliance (AOC):

The AOC is a document that confirms an entity’s compliance with PCI DSS requirements. It is signed by the entity (merchant or service provider) and the Qualified Security Assessor (QSA) if a QSA is involved.

 Different AOC Templates:

PCI DSS provides distinct templates for service providers and merchants, tailored to their respective roles and responsibilities within the cardholder data environment (CDE)​​.

 Invalid Options:

B:PCI SSC does not sign AOCs; they are signed by the merchant/service provider and the QSA.

C:AOCs differ between ROCs and SAQs, so the same template is not universally used.

D:Both the merchant/service provider and the QSA/ISA (Internal Security Assessor) must sign the AOC when applicable.

According toRequirement 1.2.1of PCI DSS v4.0.1, network security controls (NSCs), such as firewalls and segmentation controls, are used torestrict and control trafficbetween trusted and untrusted networks. This includes logical or physical network segmentation.

Option A:Incorrect. Anti-malware is addressed in Requirement 5.

Option B:Correct. NSCs control and restrict inbound and outbound traffic between logical and physical network segments.

Option C:Incorrect. Vulnerability management is under Requirement 6.

Option D:Incorrect. PAN encryption is covered in Requirement 3.5.

PerRequirement 10.6.1, PCI DSS mandates that time-synchronization technology be used, andsystems must be synchronized to a central time serverthat itself receives time from an approved external source. This ensures logs can be accurately correlated.

Option A:Incorrect. Time inconsistency arises if each system operates independently.

Option B:Incorrect. Time configuration must berestricted to authorised personnel only.

Option C:Correct. Time should be sourced from a centralised server which is in sync with reliable external sources.

Option D:Incorrect. Each system peering independently can cause inconsistencies.

Thesettlement phaseis when:

Themerchant’s acquiring bank pays the merchant, and

Theissuing bank bills the cardholder.

This occursafter authorization and clearinghave already taken place.

Option A:❌Incorrect. Authorization verifies the card and funds but doesn’t trigger payment.

Option B:❌Incorrect. Clearing exchanges transaction details between banks but doesn’t finalise funds.

Option C:✅Correct. Settlement is whenfunds are actually transferred.

Option D:❌Incorrect. Chargebacks reverse transactions, not settle them.

PCI DSS allows an entity touse both Defined and Customized Approaches, including for different sub-requirements of the same primary requirement,as long as they are eligible and justified. Entities might use the Defined Approach for standard controls and the Customized Approach where flexibility is needed.

Option A:Incorrect. PCI DSS explicitly allows mixed use per Requirement 8 guidance.

Option B:Incorrect. Compensating controls are separate from the Customized Approach.

Option C:Incorrect. Eligibility is not based solely on the absence of compensating controls.

Option D:Correct. Mixed approaches are allowed if eligibility requirements are met.

 Purpose of Classifying Media

PCI DSS v4.0 emphasizes the need to classify media based on the sensitivity of the data it contains. Media classification ensures appropriate handling, storage, and destruction processes​​.

 Media Protection Requirements

Media containing cardholder data must be securely stored, transferred, and destroyed when no longer needed.

Classification informs the level of protection required, such as encryption, physical security, or controlled access​​.

 Incorrect Options

Option B: Moving media quarterly is not a requirement.

Option C: Labeling as "Confidential" is insufficient without a comprehensive protection strategy.

Option D: Destruction schedules should depend on retention requirements and data sensitivity, not a universal timeline.

Requirement9.9.2of PCI DSS v4.0.1 mandates that entitiesregularly inspect POS devicesto detect signs of tampering or skimming. This includes physical inspections to identify unexpected additions, unauthorized stickers, broken seals, etc.

Option A:Correct. Regular inspection for skimming/tampering is required.

Option B:Incorrect. There is no mandate for manufacturer serial number verification.

Option C:Incorrect. PCI DSS does not require routine replacement of device identifiers or labels.

Option D:Incorrect. Devices may be investigated if compromised, but not necessarily destroyed.

 PAN Transmission Protection

PCI DSS Requirement 4.1 mandates strong cryptography for PAN during transmission over both public and private wireless networks to prevent unauthorized interception​​.

 Incorrect Options

Options B and D: PAN protection is not required for private wired networks.

Option C: PAN must be protected during transmission over public wireless networks.

 Testing with Live PANs

PCI DSS Requirement 6.4.3 requires that live PANs (Primary Account Numbers) only be used in secure and controlled environments within the CDE.

Pre-production environments located within the CDE must adhere to all PCI DSS requirements for security and monitoring​​.

 Prohibited Uses

Testing with live PANs in environments outside the CDE violates PCI DSS. Only simulated data should be used in less secure testing environments.

 Incorrect Options

Option A: Production environments are for real transactions, not testing.

Option B: Test environments outside the CDE are insecure for live PANs.

Option D: The QSA environment is irrelevant to the organization’s CDE testing controls.

As specified underRequirement 11.5.2.1, comparisons of critical files (e.g., config files, executables) using change-detection mechanisms (e.g., FIM tools)must occur at least weekly. This ensures timely detection of unauthorized changes or tampering.

Option A:✅Correct. Weekly is theminimum frequencyrequired.

Option B:❌Incorrect. A defined "period" is not sufficient unless it's weekly or more frequent.

Option C:❌Incorrect. Scans should not wait for changes; they should detectunexpectedones.

Option D:❌Incorrect. Monthly is too infrequent for PCI DSS compliance.

PCI DSSRequirement 11.5.2mandates the use of file-integrity monitoring (FIM) or change-detection tools to monitorcritical filessuch as system binaries, configuration files, and system parameters.

Option A:❌Incorrect. Manuals are not critical system files.

Option B:❌Incorrect. Regularly changing files (e.g., logs or temp files) are typically excluded.

Option C:❌Incorrect. Policies and procedures are reviewed but not subject to FIM.

Option D:✅Correct. System config and parameter files must bemonitored for unauthorised changes.

According toSection 12.2.3.3 of PCI DSS v4.0.1, aPartial Assessmentis defined as a result whereat least one PCI DSS requirement is marked as “Not Tested.”This is typically seen duringgap assessments or pre-validation efforts, not official compliance validation.

Option A:❌Incorrect. SAQs are self-assessments; Partial Assessment is a different concept.

Option B:❌Incorrect. Interim drafts are not labeled as “Partial”.

Option C:❌Incorrect. That is a misinterpretation of segmentation by payment channel.

Option D:✅Correct. "Not Tested" = Partial Assessment.

UnderAppendix D – Customized Approach, it is clearly stated that theentity is responsiblefor completing theControls Matrixand theTargeted Risk Analysis (TRA). The assessor may assist in completion, but accountability for content lies with the entity.

Option A:Incorrect. QSAs may assist but are not solely responsible.

Option B:Incorrect. This overstates who is responsible; only the entity is ultimately accountable.

Option C:Correct. The entity being assessed is responsible for completing the Controls Matrix and TRA.

Option D:Incorrect. Card brands or acquirers are not involved in document creation.

 Customized Approach Overview:

Under PCI DSS v4.0, entities can use a Customized Approach to meet requirements by implementing controls tailored to their environment. This allows flexibility while still achieving the intent of the security requirement.

 Role of Assessors:

Assessors (QSAs) are responsible for evaluating both the implementation of customized controls and ensuring these controls fulfill the security objectives of the PCI DSS requirements​​.

QSAs must document the evaluation, evidence reviewed, and results in the Report on Compliance (ROC).

 Controls Matrix and Targeted Risk Analysis (TRA):

The Controls Matrix and TRA are key components of the Customized Approach. QSAs assist in verifying the accuracy and completeness of these tools during assessments​​.

 Documenting in the ROC:

The ROC must include a narrative explaining the assessor’s findings regarding the customized control, validation methods, and any evidence collected​.

 Relevant PCI DSS v4.0 Guidance:

Appendix D and E of the PCI DSS v4.0 ROC Template emphasize that QSAs can evaluate and confirm adherence to the Customized Approach provided this is documented comprehensively in the ROC​.