Free CPSA Qualification CPSA Ultimate Study Guide (Updated 52 Questions) [Q22-Q41]

Rate this post

Free CPSA Qualification CPSA Ultimate Study Guide (Updated 52 Questions)

Get to the Top with CPSA Practice Exam Questions

NEW QUESTION 22
A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

None, only people on the pre-approved list may enter

When they are approved by the physical security manager or senior management

When the third party s liability insurance covers the risk

When no card production activities are taking place

NEW QUESTION 23
Which of the following must every assessor do to maintain their CPSA certification?

Complete annual requalification training or complete 3 assessments for different facilities each year

Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years

Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)

Submit evidence of internal training in a relevant area (as per the QRs)

NEW QUESTION 24
You wish to check that you are using the most current version of the Card Production requirements. What should you do?

Have the CPSA Company’s point of contact request the document

Download it from PCI SSC’s Document Library

Email a request for the document to PCI SSC

View it directly via PCI SSC Assessor Portal

NEW QUESTION 25
Which of these are guards allowed access to?

HSAs

Audit logs

Loading bays

Physical master keys that provide access to card production or provisioning areas

NEW QUESTION 26
A card production vendor employs a contracted guard service from an outside source. What is one of the responsibilities of the contracted service?

Provide only certified guards

Maintain their own liability insurance in case of losses to card material

Undergo their own Card Production assessment and provide evidence of a passing result

NEW QUESTION 27
Which of the following statements is true in relation to visitor access badges?

Each visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee

Each visitor entering the facility must wear their issued access badge above waist height

Badges with access-controls must not be issued to visitors

Unissued visitor access badges must be securely stored

NEW QUESTION 28
A vendor receives cardholder information and keys from a bank. The vendor then performs the following:
* Uses its HSM to create keys
* Creates cardholder information specific to each cardholder, including name and PAN
* Formats the data for the hardware that will put it on a card
* Writes it to an encrypted file
Which of the following best describes this process?

Data creation

Data preparation

Manufacture

Pre-personalization

NEW QUESTION 29
The receptionist responsible for the entrance and departure of visitors must have which of the following?

A shredder for the destruction of disposable visitor badges

A constant, open communication channel with a guard

An unobstructed view of the reception area at all times

A means of communicating directly with the visitor while on the premises

NEW QUESTION 30
Which of these is a requirement of the security control room?

Access must be controlled by a physical key (in case of power-failure)

Access must be monitored in real-time

At least one guard must be present at all times

Dual-control must be used to grant entry

NEW QUESTION 31
During an assessment you walk the perimeter of the building with a guard you find an emergency exit door from the facility and ask the guard what is on the other side. The guard can’t remember, and so uses their assigned, secure key to open the door and show you a corridor within the facility. What most concerns you about the situation?

The exit door should not lead into the facility

The exit door should not be capable of being opened from the outside

The guard should not have forgotten where the door leads to

The guard should have sought permission from their manager before opening the door

NEW QUESTION 32
If you have a query about a missing field in the card production reporting template, which organization is best-placed to answer it?

The payment brands

The vendor

The issuer

PCI SSC

NEW QUESTION 33
For each requirement listed in a ROC, which types of findings must have a full narrative response?

All types of findings

Non-compliant findings only

New or Closed findings only

All types except Not Applicable findings

NEW QUESTION 34
Which of the following statements is true about the facility’s non-emergency exits?

They must be contact-alarm monitored only when card production activities are taking place

They must be configured to prevent staff tailgating

They may be left unlocked when a guard is present

They must be fitted with biometric access-control devices

NEW QUESTION 35
When must HSA motion detectors generate an alarm event?

Each time movement is detected

Each time movement is detected outside of regular business hours

Each time movement is detected and the access-control system indicates the room is occupied

Each time movement is detected and the access-control system indicates the room is not occupied

NEW QUESTION 36
For how long must a CPSA Company maintain workpapers and technical information obtained during an assessment?

Until each applicable payment brand has accepted (and signed off) the ROC and AOC

As long as the entity under assessment is a client of the CPSA Company

3 years

1 year

NEW QUESTION 37
The vendor’s technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened. Why might this cause a problem for their assessment?

If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it

During working hours, the alarm should be managed in the security control room, or by a central monitoring service

If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm

During busy times, the local police may not be able to respond

NEW QUESTION 38
A vendor discovers that a recent shipment of cards is missing a set. Which of the following responses would you expect in a compliant organization?

An immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement

The head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days

A report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police

After an incident review, the VPA, issuer and law enforcement are all notified within 24 hours

NEW QUESTION 39
A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is functioning correctly. When must the status of the access change?

Only when an unauthorised badge is presented

Only when the person has successfully completed the access cycle

Upon initial entry of the person into the device, prior to completion of the access cycle

Upon initial presentation of an authorised badge, prior to completion of the access cycle

NEW QUESTION 40
A vendor puts cardholder information into a chip by sliding a payment card through a machine that programs it and verifies the dat a. The chip can make contactless transactions. Which of the following best describes the vendor’s activity?

Card personalization

Host Card Emulation (HCE) provisioning

Secure Element (SE) provisioning

Fulfillment

NEW QUESTION 41
A cardholder wants to make purchases using their phone, so they have their cardholder information programmed into their SIM card using their mobile phone provider. Which of the following best describes this system?

Card personalization

Host Card Emulation (HCE) provisioning

Secure Element (SE) provisioning

Over-the-air (OTA) provisioning