The Qualified Security Assessor V4 Exam (QSA_New_V4)

 Compensating Controls Definition and Purpose

A compensating control is an alternate measure that satisfies the intent of a specific PCI DSS requirement and provides an equivalent level of security.

The rationale and risk mitigation must be explicitly documented using the Compensating Control Worksheet (CCW).

 Mandatory Documentation

PCI DSS v4.0 mandates the use of a CCW when implementing compensating controls. This applies regardless of acquirer approvals​​.

The CCW requires detailed documentation including:

Constraints preventing the original requirement from being implemented.

Justification for the compensating control.

Description of the control and evidence of its effectiveness.

 Using Existing Requirements

If an existing PCI DSS requirement (e.g., Requirement 5 for antivirus) is already implemented and can mitigate the risks of not meeting another requirement, it may qualify as a compensating control​​.

 Approval and Review Process

QSAs must validate the implementation, effectiveness, and appropriateness of compensating controls during the assessment process​

PCI DSS clearly states inRequirement 11.4.5and in theScoping Guidancethat if segmentation is used, the assessor must verify thesegmentation is effective— meaning it must be technically and operationally validated to ensure that it properly isolates the Cardholder Data Environment (CDE) from out-of-scope networks.

Option A:Too narrow. While allowing only necessary traffic is important, the verification involves more than that.

Option B:Incorrect. Payment brands do not “approve” segmentation.

Option C:Incorrect. PCI DSS focuses on effectiveness, not brand-specific device use.

Option D:Correct. Assessor must ensure that segmentation controls areproperly configured and function as intended.

When a cryptographic key is retired and replaced, it is essential to ensure that the retired key is no longer used for encryption purposes to maintain the security of the cryptographic system.​

Option A:Correct. Retired keys must not be used for encryption operations to prevent potential security vulnerabilities. However, they may be retained for decryption purposes if necessary, such as decrypting existing data encrypted under the retired key.​

Option B:Incorrect. PCI DSS does not specify a mandatory retention period for retired cryptographic key components before disposal. Retention periods should align with the entity ' s data retention policies and legal requirements.​

Option C:Incorrect. Assigning a new key custodian is not a mandatory requirement upon key retirement and replacement, though proper key management practices should ensure that custodianship is clearly defined and documented.​

Option D:Incorrect. While data encrypted under a retired key should be re-encrypted with the new key or securely managed, PCI DSS does not mandate the destruction of such data solely due to key retirement.​

For more information on cryptographic key management practices, refer toRequirement 3: Protect Stored Account Datain thePCI DSS v4.0.1document.​Wikipedia

According toRequirement 9.3.1and9.4.1.2, physical access control mechanisms — including badge readers — must beprotected against tampering or disablingto prevent unauthorized access and maintain the integrity of access logs.

Option A:Correct. Physical access control systems must be protected from tampering.

Option B:Incorrect. Video cameras are requiredonly where appropriate; badge access may suffice.

Option C:Incorrect. Access logs must beretained for at least three months, not deleted monthly (see 9.4.1.3).

Option D:Incorrect. Motion sensors are not specifically required.

Requirement 4.2.1.1states that PAN must beprotected with strong cryptographywhenever transmitted overopen or public networks, includingprivate wirelesswhere security is not assured. While not allprivate wired networksrequire encryption,wirelessis generally considered untrusted.

Option A:✅Correct. PAN must be encrypted overprivate wireless networksdue to potential interception risks.

Option B:❌Incorrect. Privatewirednetworks typically don’t require encryption unless they’re untrusted.

Option C & D:❌Incorrect. PANalways requires protectionover public networks.

Compensating controls are alternative measures implemented when an entity cannot meet a specific PCI DSS requirement due to legitimate technical or business constraints. These controls must sufficiently mitigate the associated risk and be commensurate with the intent of the original PCI DSS requirement.​

Option A:Incorrect. Even if all other PCI DSS requirements are met, a compensating control is necessary when a specific requirement cannot be directly satisfied.​

Option B:Correct. A compensating control must effectively address and mitigate the risk associated with the inability to meet a particular PCI DSS requirement.​

Option C:Incorrect. While existing controls can support a compensating control, they must collectively address the risk of the unmet requirement and cannot merely be another existing PCI DSS requirement.​

Option D:Incorrect. A compensating control worksheet is mandatory to document the rationale, assessment, and validation of the compensating control, regardless of acquirer approval.​

For detailed guidance on compensating controls, refer toAppendix B: Compensating Controlsin thePCI DSS v4.0.1document.​

PCI DSS allows for theuse of truncation and hashingfor protecting PAN, butRequirement 3.4.1and its guidance warn againstcombining hashed and truncated PANsin such a way that the original PAN could be reconstructed. If both formats exist,controls must ensurethey can ' t be used together to reverse-engineer the PAN.

Option A:✅Correct. Controls must ensure PAN cannot be reconstructed using both versions.

Option B:❌Incorrect. A hashed PAN does not need truncation — hashing is a separate mechanism.

Option C:❌Incorrect. PCI DSS aims to prevent correlation, not encourage it.

Option D:❌Incorrect. They can coexist, but must be secured so that PAN cannot be derived.

 PCI PIN Transaction Security (PTS) Standard:

The PCI PTS standard focuses on securing Point-of-Interaction (POI) devices, such as payment terminals, that process payment card transactions and protect account data during capture​​.

 Clarifications on Covered Areas:

This standard includes specifications for physical and logical security controls to prevent unauthorized access to sensitive cardholder data on POI devices.

 Invalid Options:

B:Secure coding practices are addressed by PCI PA-DSS (Payment Application Data Security Standard).

C:Cryptographic algorithm development is not specific to PCI PTS.

D:End-to-end encryption solutions are not covered under PCI PTS.

According toRequirement 12.10.1, an effectiveincident response plan (IRP)must include steps to detect, respond to, and contain incidents such asunauthorised wireless access points. PCI DSS11.2.1also mandates quarterly rogue AP detection.

Option A:❌Incorrect. Notification to PCI SSC is not required; notification goes toacquirers/payment brands.

Option B:✅Correct. The IRP must includeresponse to unauthorised wireless access detection.

Option C:❌Incorrect. Records must beretained, not deleted.

Option D:❌Incorrect. Retaliatory or offensive actions arenot allowed or recommended.