Free CPSA_P_New Exam Braindumps - New 2024 PCI Pratice Exam [Q29-Q51]

Q29. In which of the following locations must the CCTV and access control servers be located?

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

Within the secure server room inside of the HSA

Q30. Which of the following must be used by the vendor to protect doors that provide access to buildings containing air conditioning equipment?

Security tape that will leave an observable trace each time a door is opened

Electrical contacts that log each open and close event to a secure system memory

Magnetic contacts that are permanently alarmed and that are connected to the security control-room panels

Physical locks with a limited set of keys under constant supervision by a guard in the security control-room

Q31. Which of these is a requirement of the security control room?

Access must be controlled by a physical key (in case of power-failure)

Access must be monitored in real-time

At least one guard must be present at all times

Dual-control must be used to grant entry

Q32. Which of the following must every assessor do to maintain their CPSA certification?

Complete annual requalification training or complete 3 assessments for different facilities each year

Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years

Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)

Submit evidence of internal training in a relevant area (as per the QRs)

Q33. A vendor discovers that a recent shipment of cards is missing a set. Which of the following responses would you expect in a compliant organization?

An immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement

The head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days

A report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police

After an incident review, the VPA, issuer and law enforcement are all notified within 24 hours

Q34. Before you go on-site, the vendor’s primary contact communicates a legitimate reason for delaying the assessment for several months. Who can approve the change in the report delivery schedule?

Vendor senior management

Payment brands

Affected issuers

PCI SSC

Q35. To liberate a person detected inside of the inner shipping delivery room and stop the alarm, the software monitoring the access-control system must only allow the opening of which door?

The external facing door

The internal facing door

The last activated door

The least secure door

Q36. The receptionist responsible for the entrance and departure of visitors must have which of the following?

A shredder for the destruction of disposable visitor badges

A constant, open communication channel with a guard

An unobstructed view of the reception area at all times

A means of communicating directly with the visitor while on the premises

Q37. After reviewing their completed ROC and AOC, which state that they are compliant, the vendor wishes to be listed on PCI SSC’s list of Compliant Card Vendors. How should you assist them with the listing process?

Submit the full ROC to PCI SSC

Submit only the AOC to PCI SSC

Inform the vendor that PCI SSC does not list compliant vendors

Inform the vendor that they must request a listing via the payment brand(s) that received their ROC

Q38. An assessor must provide which of the following to their client at the start of every assessment?

CPSA Feedback Form

Quality Assurance Manual

Attestation of Compliance

Vendor Release Agreement

Q39. Which of the following security awareness measures is required for compliance?

Annual training on common attack methods

Annual training on use of mantraps

Security awareness exams for all personnel

Security posters must be placed in the facility

Q40. A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Assessor

Issuing banks

Payment brands

PCI SSC

Q41. Which of the following personnel changes must result in the vendor notifying the Vendor Program Administration (VPA)?

Adding additional rights to someone’s role to give them access to the mam production vault

Any change to a role that directly affects the security of card products and related components

Hiring someone that will directly interact with the card issuers

Promoting someone to senior management level

Q42. A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

None, only people on the pre-approved list may enter

When they are approved by the physical security manager or senior management

When the third party s liability insurance covers the risk

When no card production activities are taking place

Q43. Which of the following statements is true about the facility’s non-emergency exits?

They must be contact-alarm monitored only when card production activities are taking place

They must be configured to prevent staff tailgating

They may be left unlocked when a guard is present

They must be fitted with biometric access-control devices

Q44. During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Employee information, including background checks, must be stored for at least seven years

Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

The vendor must retain the background information for at least 18 months after termination of contract

The vendor must only retain background information for all current employees, not for those that have been terminated

Q45. How frequently must alarms on external doors of a card production and provisioning vendor environment be tested?

Every day

Every week

Every month

Every 3 months

Q46. If a vendor plans to terminate an employee, which of these must be done?

The employee must be escorted from the premises immediately

The employee’s locker and desk must be searched prior to termination

The Human Resources department must be notified prior to termination

The security manager must be notified in writing prior to termination

Q47. John works for ACME Inc Personalizers. an organization that personalizes payment cards as well as printing the corresponding PIN mailers for distribution directly to the cardholder. Which of the following statements is true?

If John is involved in card personalization then he must not be involved in the printing of the corresponding PINs

If John is involved in card personalization, then he must never be involved in the card shipment process

If John is involved in card personalization, then he must never be involved in PIN printing

If John is involved in PIN printing, then he must never be involved in the card shipment process

Q48. A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Payment brands

Issuing banks

PCI SSC

Assessor

Q49. Which of the following statements about unsolicited visitors is true?

They must be turned away

They must complete an NDA before entry is granted

They must be able to prove a legitimate reason for their visit prior to entry

They must be registered, their identities confirmed, and must be allocated an escort before entry

Free CPSA_P_New Exam Braindumps – New 2024 PCI Pratice Exam [Q29-Q51]

Leave a Reply Cancel reply