PCI - Latest Training Dumps

Card Production Security Assessor (CPSA) Qualification Exam Practice Tests 2023 | Pass CPSA with confidence!

Practice CPSA Qualification CPSA exam. Online Exam Practice Tests with detailed explanations!

NO.24 During an assessment you do a walk-through of bringing card products into the HSA using the goods-tools trap. You act as production staff, using an empty cardboard box as the card products. During the process, the guard escorts you, along with the box, into the pre-press room. What is your conclusion?

Compliant, because the guard escorted you

Compliant, because the guard ensured that the card product remained under dual control

Not compliant, because an inventory of the card product did not take place prior to entry

Not compliant, because the guard escorted you

NO.25 A vendor receives cardholder information and keys from a bank. The vendor then performs the following:
* Uses its HSM to create keys
* Creates cardholder information specific to each cardholder, including name and PAN
* Formats the data for the hardware that will put it on a card
* Writes it to an encrypted file
Which of the following best describes this process?

Data creation

Data preparation

Manufacture

Pre-personalization

NO.26 Who performs regular AQM audits of CPSA companies?

Issuing banks

Payment brands

PCI SSC

Vendor

NO.27 During an assessment you walk the perimeter of the building with a guard you find an emergency exit door from the facility and ask the guard what is on the other side. The guard can’t remember, and so uses their assigned, secure key to open the door and show you a corridor within the facility. What most concerns you about the situation?

The exit door should not lead into the facility

The exit door should not be capable of being opened from the outside

The guard should not have forgotten where the door leads to

The guard should have sought permission from their manager before opening the door

NO.28 Which of the follow best describes a Technical FAQ?

Technical FAQs only apply to the specific technology as the FAQ defines it

Technical FAQs can be submitted to PCI SSC at any time

Use of the Technical FAQs is mandatory, they shall be used during an assessment

Use of the Technical FAQs is optional, they are considered guidance

NO.29 Which of the following statements about unsolicited visitors is true?

They must be turned away

They must complete an NDA before entry is granted

They must be able to prove a legitimate reason for their visit prior to entry

They must be registered, their identities confirmed, and must be allocated an escort before entry

NO.30 Where can misprinted, partially finished cards be shredded?

In any HSA room approved by the security manager

Either in the HSA printing room or destruction room

Only in the HSA destruction room

Either in the HSA destruction room or a loading bay that meets all requirements of a destruction room

NO.31 A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

PCI SSC

Assessor

Issuing banks

Payment brands

NO.32 A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Assessor

Issuing banks

Payment brands

PCI SSC

NO.33 The vendor’s technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened. Why might this cause a problem for their assessment?

If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it

During working hours, the alarm should be managed in the security control room, or by a central monitoring service

If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm

During busy times, the local police may not be able to respond

NO.34 An assessor must provide which of the following to their client at the start of every assessment?

CPSA Feedback Form

Quality Assurance Manual

Attestation of Compliance

Vendor Release Agreement

NO.35 In which of the following locations must the CCTV and access control servers be located?

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

Within the secure server room inside of the HSA

NO.36 A CPSA Company has submitted multiple reports that are incomplete and do not contain the information described in the reporting instructions. Which of the following are possible outcomes?

They may be put into remediation or revoked by the applicable payment brands

They may be put into remediation or revoked by PCI SSC

They may be fined by the applicable payment brands

They may be fined by PCI SSC

NO.37 You are driving to a vendor for their first assessment. The facility is in a rural area, twenty miles away from the nearest large town. What most concerns you about the location?

The local fire service may not be able to reach the facility within 15 minutes

Law enforcement services may not be able to reach the facility in a timely manner

Power blackouts may affect security systems

There may not be adequate retail outlets, which may cause problems when sourcing lunch items for onsite personnel

NO.38 Which of these are guards allowed access to?

HSAs

Audit logs

Loading bays

Physical master keys that provide access to card production or provisioning areas

NO.39 A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is functioning correctly. When must the status of the access change?

Only when an unauthorised badge is presented

Only when the person has successfully completed the access cycle

Upon initial entry of the person into the device, prior to completion of the access cycle

Upon initial presentation of an authorised badge, prior to completion of the access cycle

NO.40 A vendor uses codes from a chip manufacturer to ‘unlock’ chips and prepare them for use by adding applications and keys. Which of the following best describes this process?

Data creation

Data preparation

Manufacture

Pre-personalization

NO.41 Which of the following personnel changes must result in the vendor notifying the Vendor Program Administration (VPA)?

Adding additional rights to someone’s role to give them access to the mam production vault

Any change to a role that directly affects the security of card products and related components

Hiring someone that will directly interact with the card issuers

Promoting someone to senior management level

NO.42 Which of the following principles must be enforce by the HSA Access Control system?

Dual control

Dual presence

Dual control and dual presence

Dual guard entry when required

NO.43 Under which circumstances may boxes containing card stock remain unsealed within the vault?

Where stock from those boxes will be pulled multiple times per day

Where the stock from those boxes will be pulled once at the beginning of production

Always, as long as an accurate inventory is being maintained

This is never permitted

The best CPSA exam study material and preparation tool is here: https://www.trainingdump.com/PCI/CPSA-practice-exam-dumps.html

Category PCI

[Q24-Q47] Card Production Security Assessor (CPSA) Qualification Exam Practice Tests 2023 Pass CPSA with confidence!