PCI SSC QSA_New_V4 Dumps Questions Answers

PCI DSS clearly states inRequirement 11.4.5and in theScoping Guidancethat if segmentation is used, the assessor must verify thesegmentation is effective— meaning it must be technically and operationally validated to ensure that it properly isolates the Cardholder Data Environment (CDE) from out-of-scope networks.

Option A:Too narrow. While allowing only necessary traffic is important, the verification involves more than that.

Option B:Incorrect. Payment brands do not “approve” segmentation.

Option C:Incorrect. PCI DSS focuses on effectiveness, not brand-specific device use.

Option D:Correct. Assessor must ensure that segmentation controls areproperly configured and function as intended.

According toRequirement 9.4.2.2, visitors must beescorted at all timesin areas where cardholder data is stored or processed. This is a key component of physical access control and is intended to prevent unauthorised access or tampering.

Option A:✅Correct. Escorts aremandatoryfor visitors in sensitive areas.

Option B:❌Incorrect. Visitor badgesmust be distinguishablefrom employee badges.

Option C:❌Incorrect. PCI DSS requires name and firm represented, butnot full address or phone.

Option D:❌Incorrect. Visitor badges must besurrendered or deactivatedimmediately after the visit ends.

Track equivalent data— whether from a magnetic stripe or embedded chip — falls underSensitive Authentication Data (SAD)and mustnot be stored after authorisation, even if encrypted. This is covered underRequirement 3.3.1and Table 3 in PCI DSS v4.0.1.

Option A:❌Incorrect. SADmust not be stored after authorisation, regardless of encryption.

Option B:✅Correct. Track equivalent data is explicitly defined asSAD.

Option C:❌Incorrect. SAD is fullyin-scopefor PCI DSS.

Option D:❌Incorrect. Requirement 3.2 and 3.3 specifically address SAD.