QSA_New_V4 Exam Dumps : Qualified Security Assessor V4 Exam

Requirement 10.5.1.1requires thataudit logs be protected from unauthorised viewing and modification, and access should berestricted to individuals with a job-related need to view them. This principle aligns with least privilege and ensures accountability.

Option A:❌Incorrect. The person who performed the action may not need to view logs.

Option B:❌Incorrect. Read/write access istoo permissive.

Option C:❌Incorrect. Not all administrators need access to logs.

Option D:✅Correct. Access should bebased on job function.

Requirement 11.5.1mandates that organisations deployintrusion-detection or prevention toolstomonitor traffic and generate alertsfor suspicious activity. The goal is tonotify personnel quicklyof a possible breach.

Option A:❌Incorrect. IDS/IPS isnot requiredon every component — only where it adds value.

Option B:✅Correct. IDS/IPS must be configured toalert on potential compromises.

Option C:❌Incorrect. Segmentation is a separate concern under Requirement 1.

Option D:❌Incorrect. IDS is not for discovering cardholder data.

 Definition of Quarterly:

PCI DSS defines "quarterly" as occurring once within each calendar quarter. This means the activity must happen at least once in Q1, Q2, Q3, and Q4, with no rigid restrictions on specific days​​.

 Clarification on Other Options:

B:While 95–97 days approximates a quarter, it is not mandated as a rigid timeframe.

C/D:Fixed dates (e.g., 15th or 1st of specific months) are not prescribed in PCI DSS.