PCI Approved Scanning Vendor (ASV) Online Practice Test

These questions are part of the practice quiz. Start practicing

• Which statement describes requirements for a firewall at each Internet connection and between any DMZ and the internal network?
• QIR stands for what?
• Which of the following is NOT considered an injection flaw?
• Improper error handling can lead to which risk?
• Which statement implements a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports?
• Which Appendix addresses the additional PCI DSS requirements for entities using SSL/early TLS?
• Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?
• Which two sections comprise the Base Metric in the CVSS scoring system?
• Injection category identification?
• After vulnerabilities are identified in internal scans, what should be done?
• Which statement requires documentation and business justification and approval for use of all services, protocols, and ports allowed?
• Which ASV Scan characteristic accounts for load balancers?
• Which option lists the correct PCI DSS requirement concerns ASVs performing external vulnerability scans?
• Which statement mandates installing perimeter firewalls between wireless networks and the cardholder data environment and allowing only authorized traffic?
• Which of the following is a characteristic of ASV Scans?
• How should CVSS scores be used to determine whether a vulnerability is failing?
• Which CVSS base metric sub-score category includes Confidentiality, Integrity, and Availability?
• Which of the following is NOT an example of a component listed in the ASV Scan Report?
• Which SAQ applies to a merchant with only card-present dial-out terminals?
• Which statement about PA-DSS usage is correct?
• Which wireless control is explicitly prohibited?
• Which brand uses Account Information Security (AIS) Program as its PCI DSS program?
• Insecure communications refers to which practice?
• Which SAQ applies to a merchant with a standalone payment application connected to the Internet?
• Which of the following are included in cryptographic key operations under PCI P2PE?
• Which statement best summarizes secure development requirements under PCI DSS?
• What are the three items in the CVSS Impact metrics?
• Which PCI DSS compliance program is associated with JCB?
• Entities with existing SSL/early TLS implementations must have what in place?
• Which of the following is a PCI DSS role that correctly matches 'QSA'?
• Which statement limits inbound Internet traffic to IP addresses within the DMZ?
• Which item is a requirement of PCI P2PE?
• Which CVSS metric set does Exploitability belong to according to the material?
• Which statement limits inbound Internet traffic to IP addresses within the DMZ?
• A component, as defined on the ASV Scan Report Attestation of Scan Compliance, includes any host, virtual host, IP address, domain, FQDN or unique vector into a system or cardholder data environment.
• What is the frequency of external vulnerability scans performed by an Approved Scanning Vendor (ASV)?
• Which standard covers encryption, decryption, and Key management requirements for point-to-point encryption solutions?
• Which action is recommended to minimize potential attack surface by removing unnecessary components?
• Which statement accurately describes SSL usage on host devices in PCI scanning?
• A component in the ASV Scan Report can be identified by which of the following?
• Which SAQ would apply to a merchant using end-to-end encryption with PCI PTS POI devices and IP network communication?
• What information is included on the Attestation of Scan Compliance cover page for contact details?
• SSL/early TLS is not considered strong cryptography and may not be used as a security control, except by POS POI terminals verified as not susceptible to known exploits.
• Which SAQ applies to an online merchant that displays a PCI DSS compliant service provider's payment page in an IFRAME, with all page content coming from the PSP?
• Which CVSS Exploitation metric describes the level of attacker authentication required to access the target?
• Security training frequency should be:
• What action is recommended for any required services, protocols, or daemons that are insecure?
• What term is key when discussing SSL/TLS suitability for PCI scanning?
• Which statement is true about service providers in PCI context?
• Which standard applies to secure payment applications to support PCI DSS compliance?
• Which statement best aligns with the upgrade guidance for SSL/early TLS?
• Which description best represents what the P2PE Standard covers?
• According to requirement 11.2.2, how often must external vulnerability scans be performed by an Approved Scanning Vendor (ASV)?
• Which SAQ applies to an online merchant with a payment page that accepts cardholder data, but transmits the data to a PCI DSS compliant service provider?
• Is a vulnerability with a CVSS score greater than 4.0 automatically considered failing?
• What is the primary function of a web application firewall in front of public-facing web apps?
• When transmitting cardholder data over open networks, which practice is required?
• What action regarding private IP addresses should you take?
• When should development, test, and/or custom application accounts be removed?
• Which vulnerability would automatically fail due to DNS misconfiguration, such as DNS zone transfer issues?
• Who manages the decryption environment and all decrypted account data in PCI P2PE solutions?
• What are the 3 sections of the CVSS Environmental, Impact Subscore Modifiers Metric?
• Exploitation section of the CVSS is made up of which of the following?
• A false positive can be issued if evidence shows the vulnerability does not exist, or mitigated by compensating control.
• Which type of administrative access must be encrypted using strong cryptography?
• Which statement describes the meaning of termination points in POS POI SSL connections?
• During PA-DSS assessment, assessor must validate installation per which guide?
• Which of the following is a PCI DSS role?
• What does PCI SSC stand for?
• After changes, vulnerability scans can be performed by which of the following?
• What does it mean to implement only one primary function per server?
• How often should internal and external vulnerability scans be performed, and when else?
• Which SAQ should a merchant use if they rely on a PCI DSS compliant service provider's hosted payment page and do not store cardholder data?
• SSL/early TLS may be used by POS POI terminals that are verified as not susceptible to known exploits.
• Which entity is responsible for forensic investigations of account data compromise?
• Which section of the Scan Report provides contact information for both the ASV and the scan customer, overall scan results, and the attestation of the ASV qualified employee?
• Which statement best describes detection of incomplete or corrupted scans?
• What is the purpose of configuring system security parameters?
• Which control is established and implemented under 8.2.3?
• Is the merchant not responsible for the results of a scanned host if the merchant marks it out of scope?
• After identifying high-risk vulnerabilities in an internal scan, what action is required?
• Which statement best describes the difference between best-practice and compliance?
• Which statement restricts inbound and outbound traffic to only what is necessary for the cardholder data environment, and denies all other traffic?
• Idle session re-authentication threshold is required after how many minutes of inactivity?
• Which of the following statements best describes the use of 'early TLS'?
• Which statement implements anti-spoofing measures to detect and block forged source IP addresses from entering the network?
• Which standard covers physical and logical security requirements for card production systems?
• Which statement about PA-DSS applications is true?
• Which standard covers physical and logical security requirements for systems and business processes?
• Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?
• What should you do with services, protocols, daemons, etc., on a system?
• Internal vulnerability scans should be performed how often?
• Which of the following is a Special Note defined by the Program Guide when detected?
• Where should system components that store cardholder data be placed?
• A vulnerability which exclusively results in denial-of-service, even if it is over the 4.0 score threshold, is not considered a failing vulnerability.
• Insecure cryptographic storage is best described as?
• An ASV must scan everything in the external scope.
• Which of the following functions is associated with acquirers?
• The PCI SSC Quality Assurance Program requires validation via the ASV Validation Test Bed every two years.
• Which mitigation technique is commonly used to defend against cross-site scripting (XSS)?
• Which statement describes the DMZ’s purpose to limit inbound traffic to authorized publicly accessible services, protocols, and ports?
• Which of the following statements best matches the content about SSL usage and upgrades?
• Directory browsing should not be allowed on which scan component?
• Which item is not listed as a Special Note?
• MO/TO merchant with all payment functions outsourced to a compliant provider should use which SAQ?
• Which of the following is a component of the CVSS Environmental, General Modifiers?
• Which of the following is a type of injection flaw mentioned?
• Which SAQ applies to a merchant using an end-to-end encryption solution (E2EE) that utilizes PCI PTS-approved POI devices which communicate with the acquirer over an IP network?
• Should private IP addresses and routing information be disclosed to unauthorized parties?
• What is the primary purpose of a formal Risk Mitigation and Migration Plan for SSL/early TLS usage?
• Which section contains the vulnerability details and CVSS scores by IP?
• The standard for validating off-the-shelf payment applications used in authorization and settlement is:
• Which PCI DSS program is associated with Cardholder Information Security Program?
• Which SAQ applies to a merchant using a validated P2PE solution listed on the PCI SSC website?
• Which frequency is required for external vulnerability scans?
• Which of the following vulnerabilities would cause an automatic failure?
• What should you do with vendor-supplied defaults before installing a system on the network?
• What does requirement 8.2 require regarding credentials?
• Which standard addresses the protection of sensitive data at the point of interaction devices and their cryptographic keys used with that protection?
• Which statement reflects requirement 8.3 about IDs?
• Which service is NOT considered secure for use in system operation?
• Rescans should verify removal according to which requirement's ranking?
• It is compulsory to submit scan report results according to each payment brand's compliance reporting requirements.
• What must be kept up to date to maintain security effectiveness?
• Which SAQ type applies to a service provider using only web-based virtual terminals?
• In PCI P2PE, who performs all cryptographic operations?
• Annual secure coding training should include which element?
• Who ultimately decides the scope for the ASV scan?
• Which element should be included in annual secure coding training for developers?
• Which statement best describes SAQ B-IP?
• What is the target timeframe for installing critical security patches after release?
• Executive Summary: Which statement best describes what the Executive Summary contains?
• What should configuration standards for all system components address?
• What does DSOP stand for in PCI DSS context?
• Which of the following is NOT considered a service provider?
• The PCI SSC's Quality Assurance Program stipulates that quality assurance testing of ASV services and reporting, including validation via the ASV Validation Test Bed, must happen annually.
• Which PCI standard covers security of environments that store, process or transmit account data?
• Impact section of the CVSS is made up of which items?
• Which vulnerability is characterized by performing unauthorized actions on a web application using an authenticated user’s credentials?
• Which of the following is a valid ASV Scan characteristic?
• SSL/early TLS is considered strong cryptography and may be used as a security control.
• Which two characteristics must passwords meet according to 8.2.1?
• In Council-listed P2PE, which statement about merchant involvement is correct?
• Who reserves the right to mark any host as out of scope?
• PA-DSS applications are in scope for PCI DSS?
• The ASV Program Guide includes guidance on which topics?
• Which statement about investigating false positives with CVSS Base score >= 4.0 is true?
• What are the two sections of the CVSS Environmental, General Modifiers Metric?
• Where should intrusion-detection and intrusion-prevention systems be deployed?
• SSL and/or early TLS must not be introduced into environments where those protocols don't already exist.
• Which approach minimizes risk by separating cardholder data from untrusted networks?
• Merchants may be able to reduce PCI DSS scope when using Council-listed P2PE solutions. Which statement describes the merchant's access to account data in this scenario?
• Which statement prohibits unauthorized outbound traffic from the cardholder data environment to the Internet?
• All service providers with existing connection points to POS POI terminals that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place.
• What is the primary goal of monitoring and alerting in the cardholder data environment?
• Which of the following is NOT typically listed as a source of industry-accepted system hardening standards?
• PCI DSS applies to which entities?
• The Executive Summary includes a consolidated solution/correction plan provided as a separate line item for each IP address.
• In the Overall Scan Results, what information is not included?
• Which principle should govern connections entering the network?
• The statement 'Open Access to Databases from the Internet is considered an automatic failure' is true.
• Which of the following is considered secure for system operation?
• Which characteristic is associated with an effective scan solution?
• Who maintains the CVSS scoring system?
• Which PCI DSS compliance program is associated with Discover?
• SSL/TLS usage is specifically tied to which PCI DSS requirements?
• Keeping intrusion-detection and prevention engines, baselines, and signatures up to date supports which objective?
• After significant change, who should perform scans and rescans?
• Which PCI DSS compliance program is associated with Mastercard?
• Which entity is responsible for developing and enforcing compliance programs?
• Which vulnerability is described by injecting malicious scripts into trusted websites to be executed by other users?
• True or False: The scan customer must provide a list of all IPs in a scope for the scan.
• Which vulnerability category includes weak authentication and session management?
• What is the purpose of industry-accepted system hardening standards?
• Which statement describes the relationship between PA-DSS and PCI DSS?
• DESV stands for what?
• What are the three sections of the CVSS Temporal Metric?
• Which PCI DSS compliance program is associated with Visa Inc?
• Which of the following is an example of improper access control?
• PA-QSA stands for what?
• In wireless environments connected to the cardholder data environment, what must be changed at installation?
• The ASV is REQUIRED to investigate false positives with a CVSS Base score at or below 3.9 (a passing score).
• External vulnerability scans must be performed by what type of vendor, approved by which body, and what about rescans?
• Which requirement restricts inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic?
• Which vulnerability results in a Special Note?
• Which SAQ would apply to an online merchant that displays a PSP's payment page inside an IFRAME, with all page content from the PSP?
• A formal Risk Mitigation and Migration Plan is required for SSL/early TLS connections.
• Which standard covers secure management, processing and transmission of PIN data during online and offline payment card transaction processing?
• Entities using SSL and early TLS for POS POI terminal connections must work toward upgrading to a strong cryptographic protocol as soon as possible.
• Which statement about CVSS metrics is correct?
• Which statement best describes the requirement for avoiding generic and shared IDs in system administration?
• What is the primary purpose of intrusion-detection and intrusion-prevention systems in PCI DSS guidance?
• What must be completed if SSL or early TLS is used?
• Which SAQ would you select for a merchant using a validated P2PE solution?
• Which of the following is NOT a responsibility of Payment Brands?
• Which statement about exemptions for scanning systems is true?
• Which of the following is described as an acceptable approach to protect public-facing web applications against known attacks?
• During a self-assessment, ASVs should assist with all of the following EXCEPT:
• The lockout duration is a minimum of 2 hours.
• According to requirement 11.2, vulnerability scans conducted after changes should be performed only by an ASV.
• In which step does the payment brand network provide complete reconciliation to the merchant's bank?
• Which vulnerability is described in the 6.5.1 category?
• Which entity will ultimately approve a card purchase?
• What does CDE stand for in the PCI DSS context?
• When should internal and external vulnerability scans be performed per 11.2.2?
• Which PCI DSS compliance program is associated with Visa Europe?
• Merchants using PA-DSS validated payment applications are automatically PCI DSS compliant.
• The ASV is ENCOURAGED to investigate inconclusive scans disputed by the scan customer.
• The note indicates that vulnerability assessments for public-facing web applications are not the same as vulnerability scans performed for Requirement 11.2. Which statement best describes this distinction?
• When establishing a vulnerability management process, what ranking scheme is suggested for newly discovered vulnerabilities?
• Which section of the ASV scan report contains the detailed vulnerability findings?
• For wireless networks that transmit cardholder data, which practice is required?
• What is the primary purpose of applying vendor-supplied security patches?
• Insecure direct object references and directory traversal are examples of which vulnerability category?
• By what date did service providers must provide a secure service offering?
• Which standard is specifically associated with third-party payment applications?
• Can SSL and Early TLS be used to satisfy PCI DSS requirements?
• Which of the following is NOT a characteristic of ASV Scans?
• Which access must be protected with multi-factor authentication?
• Which statement describes firewall requirements for restricting connections between untrusted networks and the cardholder data environment?
• Which standard covers physical, logical and device security requirements for securing Hardware Security Modules (HSM)?
• If a host is marked out of scope in the ASV report, what must be documented?
• Which standard covers the protection of sensitive data at the point of interaction devices and their secure components, including cardholder PINs and account data, and the cryptographic keys used in connection with the protection of that cardholder data?
• Which brand uses Account Information Security (AIS) Program as its PCI DSS program?
• For each vulnerability in Vulnerability Details, what must be included?
• What is the third phase of the 6 Phases of ASV Scans?
• Which PCI DSS compliance program is associated with American Express?
• How many repeated failed login attempts should be allowed until an account lockout?
• Which section contains the dates for scan completion and expiration, the vulnerability summary for each IP, CVSS score, and the pass/fail status?
• Scan Reporting: Attestation of Scan Compliance — which template appendix is required?
• Which statement addresses documentation and business justification and approval for use of all services, protocols, and ports allowed?
• Which authentication methods are acceptable to authenticate all users across system components?
• TLS v1.2 is considered best practice for PCI DSS security.
• The ASV's report must include all vulnerabilities found during the scan, even if they were determined to be false positives, out of scope, or remediated prior to a rescan.
• Which ASV Scan characteristic identifies the system's services and OS?
• The Attestation of Scan Compliance section includes the signature of the ASV qualified employee.
• Which tools can be used to categorize and rank vulnerabilities and determine scan compliance?