A. You must document the work on the customized control in the ROC but you can not assess the control or the documentation.

B. You can assess the customized control and verify that the customized approach was correctly followed but you must document this in the ROC.

C. You can assess the customized control but another assessor must verify that you completed the TRA correctly.

D. Assessors are not allowed to assist an entity with the completion of the Controls Matrix or the TRA.

A. The entity must conduct ASV scans on the TPSP's systems at least annually

B. The entity must perform a risk assessment of the TPSP's environment at least quarterly.

C. The entity must monitor the TPSP's PCI DSS compliance status at least annually

D. The entity must test the TPSP's incident response plan at least quarterly

A. To allow functions with different security levels to be implemented on the same server

B. To prevent server functions with a lower security level from introducing security weaknesses to higher
-security functions on the same server

C. To reduce the security level of functions with higher-security needs to meet the needs of lower-security functions

D. To allow higher-security functions to protect lower-security functions installed on the same server

A. The hashed version of the PAN must also be truncated per PCI OSS requirements for strong cryptography.

B. Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions

C. Hashed and truncated versions of a PAN must not exist in same environment

D. The hashed and truncated versions must be correlated so the source PAN can be identified

A. They must be performed by QSA personnel

B. They must be performed at least annually

C. They must be performed after a significant change

D. They must be performed by an Approved Scanning Vendor (ASV)

A. Testing with live PANs must only be performed in the QSA Company environment

B. Pre-production (test) environments only if located outside the CDE.

C. Production (live) environments only

D. Pre-production environments that are located within the CDE

A. The security protocol is configured to support earlier versions

B. The security protocol is configured to accept all digital certificates

C. The PAN is encrypted with strong cryptography

D. The PAN is securely deleted once the transmission has been sent