Pci Dss 3.0 Extra Cards

Front 1

4 levels a Compensating Control must meet

Back 1

-Meet Intent and Rigor or original requirement

-Offset the risk the prior PCI requirement was to mitigate

-Above and Beyond

-Be commensurate with additional risk imposed by not adhering to original requirement

Front 2

What one of two conditions must be met to allow for the consideration of Compensating Control

Back 2

- Legitimate Technical Constraint

- Documented Business Constraint

Front 3

SAQ

Back 3

Self-Assessment Questionaire

Front 4

SAQ-A

Back 4

-Card not present Merchants

Front 5

SAQ-B

Back 5

-Imprint only / No Electronic Storage

Front 6

SAQ-C-VT

Back 6

Merchants using Web based virtual payment termnials - no Electronic Storage

Front 7

SAQ-C

Back 7

Merchants segmented Payment Application Systems connected to the internet

Front 8

SAQ-D

Back 8

All other merchants that do not meet any of the other requriments

Front 9

6 Milestones to PCI Prioritized Approach

Back 9

1 Remove Sensitive Authentication Data and Limit data retention

2 Protect Networks

3 Secure Payment Applications

4 Monitor and Control access to your systems

5 Protect Card Holder Data

6 Finalize Remaining compliance efforts

Front 10

Principles that apply to Virtualization and PCI

Back 10

-PCI DSS requirements apply to virtualization technologies.

-Virtualization technology introduces new risks that may not be relevant to other technologies, and that must be assessed when adopting virtualization in cardholder data environments.

-Implementations of virtual technologies can vary greatly

-No one size fits all solution

Front 11

PED

Back 11

Pin Entry Device

Front 12

SCR

Back 12

Secure Card Reader

Front 13

Services Providers must meet PCI compliance through what 2 methods

Back 13

1) Undergo their own PCI assessment and provide documentation to their customers

2)have their services reviewed during the course of each of their customers PCI DSS assessment.

Front 14

Steps for Card Processing

Back 14

Authorization

Clearing

Settlement

Front 15

Disciplinary Actions for PCI-P

Back 15

Written Warning

Suspension

Revocation

Front 16

What is the limit for an inactive id to be enabled

Back 16

90 Days

Front 17

How many log on attempts can be made until the user id locked out

Back 17

6

Front 18

password lockout duration

Back 18

30 minutes or Admin reset

Front 19

Inactivity Timer

Back 19

15 minutes

Front 20

Minimum Password History

Back 20

4

Front 21

3.4 states you can protect the PAN in the following 4 ways

Back 21

(Stated in 3.4)

1 Encryption

2 Hashing

3 Tokenization

4 Truncation

Front 22

6 Required Steps of Compensating Controls

Back 22

(Appendix B)

1) Constraints

2) Objectives

3) Identified Risk

4) Define CC

5) Validate CC

6) Maintenance

Front 23

How long is the PCI DSS Standards lifecycle

Back 23

36 Months

Front 24

Minimum Password Length

Back 24

7 Characters - must contain Alpha and Numeric

(8.2.3)

Front 25

Passwords must be changed how often

Back 25

90 days

Front 26

CDE

Back 26

Cardholder Data Environment

Front 27

How often should wireless networks be scanned for according to 11.1

Back 27

Quaterly

Front 28

Which PCI vendors are considered OPEN LOOP

Back 28

VISA

Master Card

-They neither issue cards or provide authorization

Front 29

Which PCI Members are considered Close Loop

Back 29

Amex

JCB

Discover

-They Issue cards and provide authorization

Front 30

How often should router and firewall configurations be reviewed

Back 30

6 months

Front 31

How often should look for data that exceeds defined retention time period

Back 31

Quarterly - 3.1

Front 32

What is the maximum amount of the PAN that can be displayed to someone with out a business need

Back 32

First 6 and last 4 digits - 3.3

Front 33

Split Knowledge

Back 33

The method of creating key owners that have components of an encryption key where as the piece they have is not actually part of the key itself (i.e. it is not split knowledge if you take a AES 128 bit key and break it up into two 64 bit parts)

(3.6.6)

Front 34

Critical Patches should be installed how long after release

Back 34

1 month (6.2)

Front 35

ASV

Back 35

Application Vulnerability Assessment

Front 36

3 Types of Authentication Metrics

Back 36

1) Something you know

2) Something you have

3) Something you are

(8.2)

Front 37

How long do you need to retain data from a video camera or a sign in log for sensitive areas

Back 37

Three Months (9.1)

Front 38

How often is inventory logs for media are needed be reviewed

Back 38

Annually (9.7.1)

Front 39

How long does an audit log need to be stored

Back 39

1 Year (10.7)

Front 40

How much of the Audit log needs to be immediately be available for analysis

Back 40

3 months (10.7)

Front 41

How often should wireless access points be scanned for

Back 41

Quarterly (11.1)

Front 42

How often should External and Internal ASV should be preformed

Back 42

Quarterly (11.2)

Front 43

How often should a Pen tested be done

Back 43

Annually or after any significant infrastructure or application changes have been done

Front 44

How often should security policy be reviewed and updated

Back 44

Reviewed Annually and update when the environment changes (12.1.1)

Front 45

How often should an Organization do a Risk Assessment

Back 45

Annually or when there are significant environment changes

Front 46

How often does security awareness must take place

Back 46

Annually and when first hired

Front 47

How often should a Service Providers PCI DSS compliance should be reviewed

Back 47

Annually (12.8.4)

Front 48

How often should an IRP be tested

Back 48

Annually (12.10.3)k t