[2023] Pass Assessor_New_V4 Exam - Real Questions & Answers [Q12-Q37]

[2023] Pass Assessor_New_V4 Exam - Real Questions and Answers

Assessor_New_V4 Exam Questions Get Updated [2023] with Correct Answers

NEW QUESTION # 12
Which of the following describes the intent of installing one primary function per server?

• A. To prevent server functions with a lower security level from introducing security weaknesses to higher
  -security functions on the same server
• B. To allow functions with different security levels to be implemented on the same server
• C. To allow higher-security functions to protect lower-security functions installed on the same server
• D. To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

Answer: A

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, installing one primary function per server is intended to prevent server functions with a lower security level from introducing security weaknesses to higher-security functions on the same server. This is one of the requirements for ensuring that server functions are isolated from each other.

NEW QUESTION # 13
Where can live PANs be used for testing?

• A. Production (live) environments only
• B. Pre-production environments that are located within the CDE
• C. Pre-production (test) environments only if located outside the CDE.
• D. Testing with live PANs must only be performed in the QSA Company environment

Answer: B

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, pre-production environments that are located within the cardholder data environment can be used for testing, as long as they are not accessible from untrusted networks and are monitored for any changes or vulnerabilities. This is one of the requirements for ensuring that testing environments are isolated from production environments.

NEW QUESTION # 14
Assigning a unique ID to each person is intended to ensure?

• A. Strong passwords are used for each user account
• B. Access is assigned to group accounts based on need-to-know
• C. Individual users are accountable for their own actions
• D. Shared accounts are only used by administrators

Answer: C

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, individual users are accountable for their own actions, which means they should use strong passwords, change them regularly, and not share them with anyone else. This is one of the requirements for ensuring that user accounts are properly managed and controlled.

NEW QUESTION # 15
An internal NTP server that provides lime services to the Cardholder Data Environment is?

• A. Only in scope if it provides time services to database servers.
• B. Only m scope if it stores processes or transmits cardholder data
• C. In scope for PCI DSS
• D. Not in scope for PCI DSS

Answer: C

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an internal NTP server that provides time services to the cardholder data environment is in scope for PCI DSS if it stores processes or transmits cardholder data, regardless of whether it provides authentication services to systems in the DMZ or not. This is one of the requirements for preventing unauthorized access to cardholder data using time services.

NEW QUESTION # 16
According torequirement 1,what is the purpose of "Network Security Controls?

• A. Manage anti-malware throughout the CDE.
• B. Control network traffic between two or more logical or physical network segments.
• C. Encrypt PAN when stored
• D. Discover vulnerabilities and rank them

Answer: B

Explanation:
Explanation
According to requirement 1, network security controls are intended to control network traffic between two or more logical or physical network segments, which means they should prevent unauthorized access, modification, or disclosure of cardholder data or transactions over the network. This is one of the requirements for ensuring that network security controls are implemented and maintained in accordance with PCI DSS.

NEW QUESTION # 17
An LDAP server providing authentication services to the cardholder data environment is

• A. not in scope for PCI DSS
• B. in scope only if it provides authentication services to systems in the DMZ
• C. in scope only if it stores processes or transmits cardholder data
• D. in scope for PCI DSS.

Answer: C

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, an LDAP server providing authentication services to the cardholder data environment is in scope only if it provides authentication services to systems in the DMZ. This is one of the requirements for preventing unauthorized access to cardholder data.

NEW QUESTION # 18
A sample of business facilities is reviewed during the PCI DSS assessment What is the assessor required to validate about the sample?

• A. It includes a consistent set of facilities that are reviewed for all assessments.
• B. All types and locations of facilities are represented
• C. The number of facilities in the sample is at least 10 percent of the total number of facilities
• D. Every facility where cardholder data is stored is reviewed

Answer: A

Explanation:
Explanation
when a sample of business facilities is reviewed during a PCI DSS assessment, the assessor will verify that it includes a consistent set of facilities that are reviewed for all assessments, which means it should cover all types and locations of facilities where cardholder data is stored. This is one of the requirements for ensuring that all facilities are reviewed.

NEW QUESTION # 19
Which of the following parties is responsible for completion of the Controls Matrix to* the Customized Approach?

• A. Entity being assessed
• B. Card brands or acquirer
• C. EitheraQSA,AQSA,orPClP.
• D. Only a Qualified Security Assessor (QSA)

Answer: A

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, assigning a unique ID to each person is intended to ensure individual users are accountable for their own actions, rather than shared accounts or group accounts based on need-to-know. This is one of the requirements for ensuring that user accounts are properly managed and controlled.

NEW QUESTION # 20
What should the assessor verify when testing that cardholder data is protected whenever it is sent over open public networks?

• A. The security protocol is configured to accept all digital certificates
• B. The security protocol accepts only trusted keys
• C. A proprietary security protocol is used
• D. The security protocol accepts connections from systems with lower encryption strength than required by the protocol

Answer: B

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the security protocol accepts only trusted keys.
This is one of the requirements for ensuring secure encryption and authentication.

NEW QUESTION # 21
A network firewall has been configured with the latest vendor security patches What additional configuration is needed to harden the firewall?

• A. Remove the default 'Firewall Administrator account and create a shared account for firewall administrators to use.
• B. Synchronize the firewall rules with the other firewalls m the environment
• C. Disable any firewall functions that are not needed in production
• D. Configure the firewall to permit all traffic until additional rules are defined

Answer: B

Explanation:
Explanation
According to requirement 3.1.2, a network firewall should be configured to permit only traffic that is necessary for its operation and security, which means it should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.

NEW QUESTION # 22
Which of the following is true regarding compensating controls?

• A. An existing PCI DSS requirement can be used as compensating control if it is already implemented
• B. A compensating control must address the risk associated with not adhering to the PCI DSS requirement
• C. A compensating control worksheet is not required if the acquirer approves the compensating control
• D. A compensating control is not necessary if all other PCI DSS requirements are in place

Answer: B

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, a compensating control must address the risk associated with not adhering to a PCI DSS requirement and must be approved by an authorized person before implementation. This is one of the requirements for reducing or eliminating a risk that cannot be eliminated by other means

NEW QUESTION # 23
According to the glossary, bespoke and custom software describes which type of software?

• A. Any software developed by a third party that can be customized by an entity.
• B. Virtual payment terminals
• C. Any software developed by a third party
• D. Software developed by an entity for the entity's own use

Answer: D

Explanation:
Explanation
According to the glossary, bespoke and custom software describes software developed by an entity for its own use, which means it should not be shared with other entities or sold or transferred without proper authorization. This is one of the requirements for ensuring that bespoke and custom software meets all the security standards and controls defined in Appendix E of the PCI DSS v3.2.1 Quick Reference Guide1.

NEW QUESTION # 24
What process is requited by PCI DSS (or protecting card-reading devices at the point-of-sale?

• A. Devices are physically destroyed if there is suspicion of compromise
• B. Devices are periodically inspected to detect unauthorized card stammers.
• C. The serial number of each device is periodically verified with the device manufacturer
• D. Device identifiers and security labels are periodically replaced

Answer: B

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, devices are periodically inspected to detect unauthorized card stammers using physical inspection or other methods such as software-based tools or network-based tools (such as firewalls). This is one of the requirements for preventing card skimming attacks that could compromise cardholder data.

NEW QUESTION # 25
Which statement is true regarding the PCI DSS Report on Compliance (ROC)?

• A. The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.
• B. The ROC Reporting Template provided by PCI SSC is only required for service provider assessments
• C. The assessor must create their own ROC template for each assessment report
• D. The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC

Answer: A

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor may use either their own template or the ROC Reporting Template provided by PCI SSC. This is one of the requirements for ensuring consistency and accuracy in ROCs.

NEW QUESTION # 26
What is the intent of classifying media that contains cardholder data?

• A. Ensuring that media is property protected according to the sensitivity of the data it contains
• B. Ensuring that all media is consistently destroyed on the same schedule regardless of the contents
• C. Ensuring that media is clearly and visibly labeled as 'Confidential so all personnel know that the media contains cardholder data
• D. Ensuring that media containing cardholder data is moved from secured areas an a quarterly basis

Answer: A

Explanation:
Explanation
classifying media that contains cardholder data is intended to ensure that media is property protected according to the sensitivity of the data it contains, which means it should be marked with labels or tags that indicate its level of confidentiality or integrity. This is one of the requirements for ensuring that media containing cardholder data is properly labeled.

NEW QUESTION # 27
Which of the following types of events is required to be logged?

• A. All access to external web sites
• B. All use of end-user messaging technologies
• C. All network transmissions
• D. All access to all audit trails

Answer: D

Explanation:
Explanation
all network transmissions must be logged by an entity's security information and event management (SIEM) system or equivalent tool, which means they should record all network events and activities related to cardholder data processing and transmission. This is one of the requirements for ensuring that network transmissions are monitored and audited.

NEW QUESTION # 28
What would be an appropriate strength for the key-encrypting key (KEK) used to protect an AES 128 bit data-encrypting key (DEK)

• A. AES 128
• B. ROT 13
• C. DES256
• D. RSA512

Answer: C

Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the new key must have an appropriate strength for its intended use, which means it should have a sufficient length and complexity to resist brute-force attacks. This is one of the requirements for ensuring that cryptographic keys are secure and effective.

NEW QUESTION # 29
If segmentation is being used to reduce the scope of a PCI DSS assessment the assessor will?

• A. Verify that approved devices and applications are used for the segmentation controls
• B. Verify the segmentation controls allow only necessary traffic into the cardholder data environment.
• C. Verify the controls used for segmentation are configured properly and functioning as intended
• D. Verify the payment card brands have approved the segmentation

Answer: B

Explanation:
Explanation
According to requirement 3.1.2, if segmentation is being used to reduce the scope of a PCI DSS assessment, the assessor will verify that the segmentation controls allow only necessary traffic into the cardholder data environment, which means they should not allow any traffic until additional rules are defined. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.

NEW QUESTION # 30
What must the assessor verify when testing that PAN is protected whenever it is sent over the Internet?

• A. The PAN is securely deleted once the transmission has been sent
• B. The security protocol is configured to accept all digital certificates
• C. The security protocol is configured to support earlier versions
• D. The PAN is encrypted with strong cryptography

Answer: D

Explanation:
Explanation
when PAN is sent over the Internet, PAN must be encrypted with strong cryptography, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.

NEW QUESTION # 31
Which statement is true regarding the presence of both hashed and truncated versions ofthe same PAN in an environment?

• A. The hashed and truncated versions must be correlated so the source PAN can be identified
• B. Hashed and truncated versions of a PAN must not exist in same environment
• C. Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions
• D. The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.

Answer: B

Explanation:
Explanation
According to requirement 4, when a cryptographic key is retired and replaced with a new key, the hashed and truncated versions of the same PAN must not exist in the same environment, which means they should not be stored or transmitted together. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.

NEW QUESTION # 32
Which scenario meets PCI DSS requirements for critical systems to have correct and consistent time?

• A. Access to time configuration settings is available to all users of the system.
• B. Each internal system peersdirectorywith an external source to ensure accuracy of time updates
• C. Central time servers receive time signals from specific, approved external sources
• D. Each internal system is configured to be its own time server.

Answer: C

Explanation:
Explanation
critical systems must have correct and consistent time, which means they should use a reliable time source and synchronize their clocks with other systems. This is one of the requirements for ensuring that critical systems have accurate time.

NEW QUESTION # 33
If disk encryption is used to protect account data what requirement should be met for the disk encryption solution?

• A. The decryption keys must be associated with the local user account database
• B. The decryption keys must be stored within the local user account database
• C. Access to the disk encryption must be managed independently of the operating system access control mechanisms
• D. The disk encryption system must use the same user account authenticator as the operating system

Answer: C

Explanation:
Explanation
when disk encryption is used to protect account data, access to the disk encryption must be managed independently of the operating system access control mechanisms, which means it should not be affected by changes in the operating system settings or permissions. This is one of the requirements for ensuring that disk encryption is secure and effective.

NEW QUESTION # 34
In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place''?

• A. Details of how the assessor observed the entity s systems were not compliant with the requirement
• B. Details of the entity s reason for not implementing the requirement
• C. Details of how the assessor observed the entity s systems were compliant with the requirement
• D. Details of the entity s project plan for implementing the requirement

Answer: C

Explanation:
Explanation
when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity's systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.

NEW QUESTION # 35
Which scenario describes segmentation of the cardholder data environment (CDE) for the purposes of reducing PCI DSS scope?

• A. A network configuration that prevents all network traffic between the CDE and out-of-scope networks
• B. Routers that monitor network traffic flows between the CDE and out-of-scope networks
• C. Firewalls that log all network traffic flows between the CDE and out of-scope networks
• D. Virtual LANs that route network traffic between the CDE and out-of-scope networks

Answer: A

Explanation:
Explanation
According to requirement 3.1.2, a network configuration that prevents all network traffic between the cardholder data environment and out-of-scope networks can be used as a segmentation approach for reducing PCI DSS scope, which means it should isolate each customer's cardholder data from other customers' cardholder data and prevent unauthorized access or disclosure. This is one of the requirements for ensuring that network firewalls are not exposed to unnecessary or unwanted traffic.

NEW QUESTION # 36
Which of the following statements is true regarding track equivalent data on the chip of a payment card?

• A. It is out of scope for PCI DSS
• B. It is sensitive authentication data
• C. It is not applicable for PCI DSS Requirement 3.2
• D. It is allowed to be stored by merchants after authorization if encrypted

Answer: B

Explanation:
Explanation
According to the PCI DSS v3.2.1 Quick Reference Guide1, track equivalent data on the chip of a payment card is sensitive authentication data, which means it can be used to authenticate a cardholder or a transaction, but it should not be stored or transmitted by merchants after authorization if encrypted. This is one of the requirements for preventing unauthorized access to sensitive authentication data.

NEW QUESTION # 37
......

Practice Assessor_New_V4 Questions With Certification guide Q&A from Training Expert VCEDumps: https://prep4sure.vcedumps.com/Assessor_New_V4-examcollection.html