QSA_New_V4 無料問題集「PCI SSC Qualified Security Assessor V4」

（A）The AOC must be signed by both the merchant/service provider and by PCI SSC.

（B）The same AOC template is used for ROCs and SAQs.

（C）The AOC must be signed by either the merchant/service provider or the QSA/ISA.

（D）There are different AOC templates for service providers and merchants.

（A）All types and locations of facilities are represented.

（B）It includes a consistent set of facilities that are reviewed for all assessments.

（C）The number of facilities in the sample is at least 10 percent of the total number of facilities.

（D）Every facility where cardholder data is stored is reviewed.

（A）Ensuring that all media is consistently destroyed on the same schedule, regardless of the contents.

（B）Ensuring that media containing cardholder data Is moved from secured areas an a quarterly basis.

（C）Ensuring that media is properly protected according to the sensitivity of the data it contains.

（D）Ensuring that media is clearly and visibly labeled as "Confidential" so all personnel know that the media contains cardholder data.

（A）User access to the database is only through programmatic methods.

（B）Direct queries to the database are restricted to shared database administrator accounts.

（C）Application IDs for database applications can only be used by database administrators.

（D）User access to the database is restricted to system and network administrators.

（A）Intrusion detection techniques are required to alert personnel of suspected compromises.

（B）Intrusion detection techniques are required to identify all instances of cardholder data.

（C）Intrusion detection techniques are required on all system components.

（D）Intrusion detection techniques are required to isolate systems in the cardholder data environment from all other systems.

（A）Chargeback

（B）Clearing

（C）Settlement

（D）Authorization

（A）The hashed version of the PAN must also be truncated per PCI DSS requirements for strong cryptography.

（B）The hashed and truncated versions must be correlated so the source PAN can be identified.

（C）Hashed and truncated versions of a PAN must not exist in same environment.

（D）Controls are needed to prevent the original PAN being exposed by the hashed and truncated versions.