A. Replace the need for quarterly ASV scans.

B. Ensure all vulnerabilities are addressed within 30 days.

C. Ensure that critical security patches are installed at least quarterly.

D. Prioritize the highest risk items so they can be addressed more quickly.

A. Occurring at some point in each quarter of a year.

B. At least once every 95-97 days.

C. On the 15th of each third month.

D. On the 1st of each fourth month.

A. All use of end-user messaging technologies.

B. All access to all audit trails.

C. All access to external web sites.

D. All network transmissions.

A. It is not applicable for PCI DSS Requirement 3.2.

B. It is out of scope for PCI DSS.

C. It is allowed to be stored by merchants after authorization, if encrypted.

D. It is sensitive authentication data.

A. Secure coding practices for commercial payment applications.

B. End-to-end encryption solutions for transmission of account data.

C. Development of strong cryptographic algorithms.

D. Point-of-interaction devices used to protect account data.

A. Application vendor manuals

B. Security policy and procedure documents

C. System configuration and parameter files

D. Files that regularly change

A. The ROC Reporting Template and instructions provided by PCI SSC should be used for all ROCs.

B. The assessor must create their own ROC template tor each assessment report.

C. The ROC Reporting Template provided by PCI SSC is only required for service provider assessments.

D. The assessor may use either their own template or the ROC Reporting Template provided by PCI SSC.

A. User access to the database is only through programmatic methods.

B. Application IDs for database applications can only be used by database administrators.

C. Direct queries to the database are restricted to shared database administrator accounts.

D. User access to the database is restricted to system and network administrators.