The PCI Internal Security Assessor RetakeExam (ISA-N_Retake)

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , intrusion detection techniques are required to alert personnel of suspected compromises that could compromise cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , any in-scope system except for those identified as not at risk from malware must have anti-malware solutions installed and configured according to best practices. This is one of the requirements for preventing malware infections that could compromise cardholder data.

According to requirement 1, network security controls are intended to control network traffic between two or more logical or physical network segments, which means they should prevent unauthorized access, modification, or disclosure of cardholder data or transactions over the network. This is one of the requirements for ensuring that network security controls are implemented and maintained in accordance with PCI DSS.

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , a compensating control must address the risk associated with not adhering to a PCI DSS requirement and must be approved by an authorized person before implementation. This is one of the requirements for reducing or eliminating a risk that cannot be eliminated by other means

According to the PCI DSS v3.2.1 Quick Reference Guide 1 , business facilities and system components can be sampled for testing during a PCI DSS assessment, as long as they are not critical components or components that are not in scope for testing. This is one of the requirements for ensuring that testing covers all relevant components and processes.

all network transmissions must be logged by an entity’s security information and event management (SIEM) system or equivalent tool, which means they should record all network events and activities related to cardholder data processing and transmission. This is one of the requirements for ensuring that network transmissions are monitored and audited.

when PAN is sent over the Internet, PAN must be encrypted with strong cryptography, which means it should use encryption techniques such as WEP, WPA, WPA2, or TLS/SSL to prevent unauthorized access or interception. This is one of the requirements for ensuring that PAN is protected from unauthorized access or interception.

The customized approach is a new option in PCI DSS v4.0 that allows entities to use alternate security controls or new technologies that meet the PCI DSS Customized Approach Objective for a requirement 1 .  The customized approach requires the entity to complete and document a Controls Matrix and a Targeted Risk Analysis (TRA) for each customized control, and to provide this documentation to the assessor 2 .  The assessor’s role is to review the documentation, assess the customized control, and verify that the customized approach was correctly followed 3 .  The assessor must also document the assessment of the customized control in the Report on Compliance (ROC), using the ROC Template provided by PCI SSC 4 . Therefore, the correct answer is option B.

The other options are not true regarding the role of the assessor in the customized approach.  Option A is not true because the assessor does not need another assessor to verify the TRA, as the assessor is responsible for reviewing and validating the TRA as part of the assessment process 3 .  Option C is not true because the assessor can and must assess the control and the documentation, as well as document the work on the customized control in the ROC 3 4 .  Option D is not true because the assessor is allowed to assist the entity with the completion of the Controls Matrix or the TRA, as long as the assessor does not design, develop, or implement the customized control for the entity 5 .  References :

PCI DSS v4.0: Is the Customized Approach Right For Your Organization?

PCI DSS v4.0: Roles and Responsibilities for the Customized Approach

PCI DSS v4.0 Report on Compliance Template

PCI DSS v4.0

PCI DSS v4.0: Customized Approach Explained

an entity can use both the Customized Approach and the Defined Approach to meet the same requirement, as long as it uses compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.