2023 Updated Verified CPSA Downloadable Printable Exam Dumps
The Ultimate PCI CPSA Dumps PDF Review
NEW QUESTION # 24
Who performs regular AQM audits of CPSA companies?
- A. Vendor
- B. PCI SSC
- C. Issuing banks
- D. Payment brands
Answer: B
NEW QUESTION # 25
A vendor hosts virtual secure elements holding cardholder information in their data center. When a cardholder makes a purchase, the vendor creates a payment token which is sent to the cardholder's mobile device. Which of the following best describes the vendor's activities?
- A. Over-the-air (OTA) provisioning
- B. Card personalization
- C. Host Card Emulation (HCE) provisioning
- D. Secure Element (SE) provisioning
Answer: D
NEW QUESTION # 26
After reviewing their completed ROC and AOC, which state that they are compliant, the vendor wishes to be listed on PCI SSC's list of Compliant Card Vendors. How should you assist them with the listing process?
- A. Inform the vendor that they must request a listing via the payment brand(s) that received their ROC
- B. Inform the vendor that PCI SSC does not list compliant vendors
- C. Submit only the AOC to PCI SSC
- D. Submit the full ROC to PCI SSC
Answer: A
NEW QUESTION # 27
A vendor receives cardholder information and keys from a bank. The vendor then performs the following:
* Uses its HSM to create keys
* Creates cardholder information specific to each cardholder, including name and PAN
* Formats the data for the hardware that will put it on a card
* Writes it to an encrypted file
Which of the following best describes this process?
- A. Data creation
- B. Data preparation
- C. Manufacture
- D. Pre-personalization
Answer: D
NEW QUESTION # 28
Which of the following statements about unsolicited visitors is true?
- A. They must be able to prove a legitimate reason for their visit prior to entry
- B. They must be turned away
- C. They must be registered, their identities confirmed, and must be allocated an escort before entry
- D. They must complete an NDA before entry is granted
Answer: C
NEW QUESTION # 29
The vendor's technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened. Why might this cause a problem for their assessment?
- A. If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm
- B. During busy times, the local police may not be able to respond
- C. During working hours, the alarm should be managed in the security control room, or by a central monitoring service
- D. If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it
Answer: A
NEW QUESTION # 30
Before you go on-site, the vendor's primary contact communicates a legitimate reason for delaying the assessment for several months. Who can approve the change in the report delivery schedule?
- A. PCI SSC
- B. Payment brands
- C. Vendor senior management
- D. Affected issuers
Answer: A
NEW QUESTION # 31
How frequently must alarms on external doors of a card production and provisioning vendor environment be tested?
- A. Every day
- B. Every 3 months
- C. Every week
- D. Every month
Answer: B
NEW QUESTION # 32
To liberate a person detected inside of the inner shipping delivery room and stop the alarm, the software monitoring the access-control system must only allow the opening of which door?
- A. The external facing door
- B. The least secure door
- C. The internal facing door
- D. The last activated door
Answer: C
NEW QUESTION # 33
You are driving to a vendor for their first assessment. The facility is in a rural area, twenty miles away from the nearest large town. What most concerns you about the location?
- A. The local fire service may not be able to reach the facility within 15 minutes
- B. Law enforcement services may not be able to reach the facility in a timely manner
- C. There may not be adequate retail outlets, which may cause problems when sourcing lunch items for onsite personnel
- D. Power blackouts may affect security systems
Answer: B
NEW QUESTION # 34
A vendor puts cardholder information into a chip by sliding a payment card through a machine that programs it and verifies the dat a. The chip can make contactless transactions. Which of the following best describes the vendor's activity?
- A. Fulfillment
- B. Card personalization
- C. Host Card Emulation (HCE) provisioning
- D. Secure Element (SE) provisioning
Answer: D
NEW QUESTION # 35
Which of the following must every assessor do to maintain their CPSA certification?
- A. Complete annual requalification training or complete 3 assessments for different facilities each year
- B. Submit evidence of internal training in a relevant area (as per the QRs)
- C. Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years
- D. Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)
Answer: C
NEW QUESTION # 36
In relation to guards, which of the following must the vendor ensure?
- A. A clear segregation of duties is maintained between guard and reception related job functions
- B. A clear segregation of duties is maintained between production staff and guards
- C. There is always at least one guard in the HSA and one guard in the security control room at all times
- D. There is always at least one guard on-site, including outside of working hours, to monitor security systems and premises
Answer: D
NEW QUESTION # 37
John works for ACME Inc Personalizers. an organization that personalizes payment cards as well as printing the corresponding PIN mailers for distribution directly to the cardholder. Which of the following statements is true?
- A. If John is involved in card personalization, then he must never be involved in the card shipment process
- B. If John is involved in card personalization, then he must never be involved in PIN printing
- C. If John is involved in PIN printing, then he must never be involved in the card shipment process
- D. If John is involved in card personalization then he must not be involved in the printing of the corresponding PINs
Answer: B
NEW QUESTION # 38
Which of the following security awareness measures is required for compliance?
- A. Annual training on use of mantraps
- B. Annual training on common attack methods
- C. Security awareness exams for all personnel
- D. Security posters must be placed in the facility
Answer: C
NEW QUESTION # 39
A vendor discovers that a recent shipment of cards is missing a set. Which of the following responses would you expect in a compliant organization?
- A. An immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement
- B. The head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days
- C. A report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police
- D. After an incident review, the VPA, issuer and law enforcement are all notified within 24 hours
Answer: D
NEW QUESTION # 40
Which of these are guards allowed access to?
- A. HSAs
- B. Loading bays
- C. Physical master keys that provide access to card production or provisioning areas
- D. Audit logs
Answer: C
NEW QUESTION # 41
Which of the following statements is true in relation to visitor access badges?
- A. Badges with access-controls must not be issued to visitors
- B. Each visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee
- C. Unissued visitor access badges must be securely stored
- D. Each visitor entering the facility must wear their issued access badge above waist height
Answer: B
NEW QUESTION # 42
For each requirement listed in a ROC, which types of findings must have a full narrative response?
- A. New or Closed findings only
- B. All types of findings
- C. Non-compliant findings only
- D. All types except Not Applicable findings
Answer: D
NEW QUESTION # 43
You wish to check that you are using the most current version of the Card Production requirements. What should you do?
- A. View it directly via PCI SSC Assessor Portal
- B. Have the CPSA Company's point of contact request the document
- C. Email a request for the document to PCI SSC
- D. Download it from PCI SSC's Document Library
Answer: D
NEW QUESTION # 44
......
Achive your Success with Latest CPSA Exam: https://www.testsimulate.com/CPSA-study-materials.html