Assessor_New_V4 Exam Dumps : Assessor_New_V4 Exam

According to the PCI DSS v3.2.1 Quick Reference Guide1, track equivalent data on the chip of a payment card is sensitive authentication data, which means it can be used to authenticate a cardholder or a transaction, but it should not be stored or transmitted by merchants after authorization if encrypted. This is one of the requirements for preventing unauthorized access to sensitive authentication data.

PCI DSS Requirement 12.10.1 requires entities to implement an incident response plan that includes roles, responsibilities, and communication and contact strategies for a data security incident, including notification of relevant payment brands1. This is important because each payment card brand has its own policies and procedures for dealing with a security breach, and failing to follow them or meet reporting deadlines could result in fines or loss of authority to process payment card transactions2. Therefore, an incident response plan must include procedures for notifying PCI SSC of the security incident, as well as any other entities that may require notification, whether by contract or law1. References:

• Guidance for PCI DSS Scoping and Network Segmentation
• Responding to a Cardholder Data Breach

Segmentation is a method of isolating system components that store, process, or transmit cardholder data from systems that do not, by using security controls such as firewalls, routers, switches, or other devices1. Segmentation can reduce the scope of the cardholder data environment (CDE) and thus reduce the scope of the PCI DSS assessment, as only the systems and networks within the CDE or connected to the CDE are subject to PCI DSS requirements2. However, segmentation is not mandatory for PCI DSS compliance, and it is the responsibility of the entity to define and document the scope of their CDE and the segmentation controls they use2.

The assessor’s role is to verify the scope of the CDE and the effectiveness of the segmentation controls, as specified in PCI DSS Requirement 11.3.43. The assessor must verify that the segmentation controls are configured properly and functioning as intended, and that they allow only necessary traffic into the CDE. The assessor must also perform penetration testing on the segmentation controls at least annually and after anychanges to the segmentation methods, to confirm that there are no exploitable vulnerabilities that could allow an attacker to access the CDE from out-of-scope systems3. Therefore, the correct answer is option D.

The other options are not true regarding the role of the assessor in verifying segmentation for PCI DSS. Option A is not true because the assessor must verify not only that the segmentation controls allow only necessary traffic into the CDE, but also that they are configured properly and functioning as intended, as stated in option D. Option B is not true because the assessor does not need to verify that the payment card brands have approved the segmentation, as PCI DSS does not require such approval, although the payment card brands may have their own policies and procedures for segmentation that the entity must follow2. Option C is not true because the assessor does not need to verify that approved devices and applications are used for the segmentation controls, as PCI DSS does not mandate the use of specific devices or applications for segmentation, although it requires the entity to use industry-accepted and strong methods for segmentation2. References:

• Network Segmentation - PCI Security Standards Council
• Guidance for PCI DSS Scoping and Network Segmentation
• PCI DSS v3.2.1