The Assessor_New_V4 Exam (Assessor_New_V4)

when disk encryption is used to protect account data, access to the disk encryption must be managed independently of the operating system access control mechanisms, which means it should not be affected by changes in the operating system settings or permissions. This is one of the requirements for ensuring that disk encryption is secure and effective.

The PCI DSS requires that access to databases containing cardholder data is restricted to authorized users and applications, and that direct access to such databases is prohibited. According to the PCI DSS Requirement 7.1.2, “Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities.” Furthermore, according to the PCI DSS Requirement 8.3.1, “Implement multi-factor authentication for all non-console access into the cardholder data environment for personnel with administrative access.” Therefore, the scenario that meets the PCI DSS requirements for restricting access to databases containing cardholder data is the one where user access to the database is only through programmatic methods, such as through an application interface that enforces authentication, authorization, and encryption. The other scenarios either allow direct access to the database, or do not limit the access to the least privileges necessary, or do not use multi-factor authentication for administrative access.  References : [PCI DSS v3.2.1],  Card Production Security Assessor - Logical - Credly

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , internal vulnerability scans must be performed after a significant change in any component or configuration that affects cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.

Hashing is a form of one-way encryption that transforms a data element into a unique fixed-size data element (hash value) without a way to get the original data element from the hash value 1 .  Truncation is a method of rendering the full PAN unreadable by permanently removing a segment of the PAN data 2 .  PCI DSS Requirement 3.4 states that entities must render the PAN unreadable wherever it is stored, using any of the following methods: one-way hashes based on strong cryptography, truncation, index tokens and pads, or strong cryptography with associated key-management processes and procedures 3 .  However, PCI DSS Requirement 3.4e also states that if hashed and truncated versions of the same PAN are present in the environment, additional controls must be in place to ensure that the hashed and truncated versions cannot be correlated to reconstruct the original PAN 3 .  This is because if an attacker obtains both the hashed and truncated versions of the same PAN, they may be able to use a brute-force or dictionary attack to guess the original PAN by hashing and truncating different PAN values until they find a match 4 . Therefore, the correct answer is option A.

The other options are not true regarding the presence of both hashed and truncated versions of the same PAN in an environment.  Option B is not true because PCI DSS does not require the hashed version of the PAN to be also truncated, although it is a recommended best practice to further reduce the risk of exposing the original PAN 5 . Option C is not true because PCI DSS does not require the hashed and truncated versions to be correlated, as this would defeat the purpose of rendering the PAN unreadable and increase the risk of exposing the original PAN. Option D is not true because PCI DSS does not prohibit the presence of both hashed and truncated versions of the same PAN in the same environment, as long as additional controls are in place to prevent the reconstruction of the original PAN.  References :

Protect hashed CardHolder Data according to PCI DSS 3.4 - Advantio

PCI DSS Truncation Rules and Guidelines - Truvantis

PCI DSS v3.2.1

Storing Card Numbers using hashed and truncated version of PAN

pci dss - Credit card data security - hashing, truncation and encryption - Information Security Stack Exchange

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , the intent of assigning a risk ranking to vulnerabilities is to prioritize the highest risk items so they can be addressed more quickly, rather than ensuring all vulnerabilities are addressed within 30 days or replacing the need to quarterly ASV scans or ensuring that critical security patches are installed at least quarterly. This is one of the requirements for ensuring that vulnerabilities are identified and mitigated as soon as possible.

PCI DSS Requirement 10.5.5 states that entities must restrict access to audit logs to those with a job-related need 1 . This is to prevent unauthorized or malicious users from tampering with or deleting the audit logs, which could compromise the integrity and availability of the logs and hinder the detection and investigation of security incidents.  Audit logs contain sensitive and confidential information, such as cardholder data, user identities, system activities, and security events, and therefore must be protected from unauthorized viewing, modification, or deletion 2 .  Individuals with a job-related need are those who have a legitimate and documented business reason to access the audit logs, such as system administrators, security personnel, auditors, or investigators 3 . Therefore, the correct answer is option D.

The other options are not true regarding the access control for audit log files. Option A is not true because individuals who performed the logged activity may not have a job-related need to view the audit logs, and may have a conflict of interest or malicious intent to alter or erase the logs. Option B is not true because individuals with read/write access may not have a job-related need to access the audit logs, and may pose a risk of unauthorized or accidental modification or deletion of the logs. Option C is not true because individuals with administrator privileges may not have a job-related need to access the audit logs, and may abuse their privileges or be targeted by attackers to compromise the logs.  References :

PCI DSS v3.2.1

Effective Daily Log Monitoring - PCI Security Standards Council

Logging for PCI DSS Compliance - Tueoris

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , the database server should be relocated so that it is not accessible from untrusted networks. This is one of the requirements for protecting cardholder data in transit and at rest.

PCI DSS Requirement 11.5 states that entities must deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly 1 . This is to ensure that any unauthorized or malicious changes to the files are detected and reported in a timely manner, and that the integrity and security of the files are maintained.  Critical files are those that affect the security of the cardholder data environment (CDE), such as system files, application executables, configuration files, database files, and log files 2 . Therefore, the correct answer is option A.

The other options are not true regarding the frequency of critical file comparisons for a change-detection mechanism.  Option B is not true because PCI DSS does not allow the entity to define the periodicity of the file comparisons, as it specifies a minimum frequency of at least weekly 1 .  Option C is not true because PCI DSS does not limit the file comparisons to only after a valid change is installed, as it requires the file comparisons to be performed at least weekly regardless of the change status 1 .  Option D is not true because PCI DSS does not allow the file comparisons to be performed at least monthly, as it requires a higher frequency of at least weekly 1 .  References :

PCI DSS v3.2.1

File Integrity Monitoring Tools For PCI DSS

According to requirement 4, PAN must be protected with strong cryptography for transmission over private wireless networks, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception of cardholder data over wireless networks. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.