NO.34 Requirement 11.3 – Implement a methodology for penetration testing is a best practice until June 30 2015

NO.35 Information Supplements provided by the PCI SSC “supersede” or replace PCI DSS requirements

NO.36 Identify and authenticate access to system components is the __________

NO.37 As defined by PCI DSS Requirement 7, access to cardholder data should be restricted based on which principle?

NO.38 An audit trail history should be available immediately for analysis within a minimum of

NO.39 When evaluating “above and beyond” for compensating controls, an existing PCI DSS requirement MAY be considered as compensating controls if they are required for another area, but are not required for the item under review

NO.40 PCI DSS Requirement 1 covers:

NO.41 Restrict physical access to cardholder data is the _________

NO.42 What is the Appendix A on PCI DSS 3.0?

NO.43 To be compliant with requirement 8.1.4 you have to remove/disable inactive user accounts at least every

NO.44 According to Requirement 10.4 the use of Time synchronization like NTP should be implemented on all critical systems for acquiring, distributing, and storing time.

NO.45 PCI DSS Requirement Appendix A is intended for:

NO.46 PCIPs are required to adhere to the Code of Professional Responsibility, which includes:

NO.47 PCI DSS Requirement 5 states that anti-virus software must be:

NO.48 Requirement 3.5 requires document and implement procedures to protect keys used to secure stored cardholder data against disclose and misuse. This requirement applies to keys used to encrypt stored cardholder data, and also applies to key-encrypting keys used to protect data-encrypting keys. Such key-encrypting keys must be