QSA_New_V4 Exam Questions Tutorials

PerRequirement 10.6.1, PCI DSS mandates that time-synchronization technology be used, andsystems must be synchronized to a central time serverthat itself receives time from an approved external source. This ensures logs can be accurately correlated.

Option A:Incorrect. Time inconsistency arises if each system operates independently.

Option B:Incorrect. Time configuration must berestricted to authorised personnel only.

Option C:Correct. Time should be sourced from a centralised server which is in sync with reliable external sources.

Option D:Incorrect. Each system peering independently can cause inconsistencies.

Under theCustomized Approach, assessors are responsible forderiving and documenting the testing proceduresinAppendix E of the Report on Compliance (ROC). The assessor must ensure the controlmeets the requirement objectiveand validate it throughcustom testing.

Option A:❌Incorrect. Ongoing monitoring is the entity’s responsibility, not the assessor’s.

Option B:✅Correct. The assessor must derive anddocument testingin Appendix E.

Option C:❌Incorrect. The entity documents control details; the assessor documents test results.

Option D:❌Incorrect. Theentitymust perform the targeted risk analysis, not the assessor.