Assessor_New_V4 無料問題集「PCI SSC Assessor_New_V4」

（A）The entity must monitor the TPSP's PCI DSS compliance status at least annually

（B）The entity must test the TPSP's incident response plan at least quarterly

（C）The entity must conduct ASV scans on the TPSP's systems at least annually

（D）The entity must perform a risk assessment of the TPSP's environment at least quarterly.

（A）It is out of scope for PCI DSS

（B）It is not applicable for PCI DSS Requirement 3.2

（C）It is sensitive authentication data

（D）It is allowed to be stored by merchants after authorization if encrypted

（A）Certificates are logged so they can be retrieved when the employee leaves the company

（B）Change control processes are in place to ensue certificates are changed every 90 days

（C）A different certificate is assigned to each individual user account, and certificates are not shared

（D）Certificates are assigned only to administrative groups and not to regular users

（A）Only in scope if it provides time services to database servers.

（B）Only m scope if it stores processes or transmits cardholder data

（C）Not in scope for PCI DSS

（D）In scope for PCI DSS

（A）User access to the database is only through programmatic methods

（B）Direct queries to the database are restricted to shared database administrator accounts

（C）User access to the database is restricted to system and network administrators

（D）Application IDs for database applications can only be used by database administrators

（A）Strong passwords are used for each user account

（B）Access is assigned to group accounts based on need-to-know

（C）Individual users are accountable for their own actions

（D）Shared accounts are only used by administrators