Free CPISI Practice Questions

Question 1

At a subscription retailer, authorization completes when the processor returns an approval or decline. An encrypted retry queue nevertheless retains the card verification code until the settlement batch closes that evening. The retailer does not perform issuing services. Which redesign addresses the PCI DSS violation without abandoning recurring billing?

Accepted Answer

Remove the verification code from persistent storage when authorization completes, rather than retaining it for settlement.

Answer

Keep the verification code encrypted, but limit decryption to the account that submits the settlement batch.

Answer

Retain the verification code until settlement, but move it to a separate vault with individually approved access.

Answer

Keep the verification code for subsequent charges after obtaining the cardholder's explicit consent to recurring billing.

Question 2

The proposed PCI DSS scope excludes a software-deployment server on the corporate network. It never handles account data, but its service account can replace the application running on payment servers in the cardholder data environment (CDE). Those payment servers reject all other corporate-network connections. How should the deployment server be classified?

Accepted Answer

In scope, because its deployment privileges can affect the security of the CDE.

Answer

Outside scope, because the server never stores, processes, or transmits account data.

Answer

Outside scope, because production changes receive formal approval.

Answer

In scope during deployments, but excluded between releases if no account data remains on it.

Question 3

A reconciliation clerk uses an office workstation to access a CDE application containing multiple customers' payment records. The clerk is not an administrator. Entry requires a password followed by a separate memorized PIN; no other authentication occurs. The team proposes keeping this arrangement because the connection starts inside the corporate network. Which change supplies the missing authentication factor?

Accepted Answer

Replace the PIN challenge with proof of possession of an individually assigned security token.

Answer

Require the clerk to use a longer PIN that is changed independently of the password.

Answer

Replace the PIN with a second password verified against a separately administered identity directory.

Answer

Keep both secrets and restrict connections by the workstation's IP address.

Question 4

A remediation ticket records a CVSS v4.0 Base score of 8.2. The organization's documented risk assessment treats the vulnerability as noncritical and sets a 45-day patch deadline. The applicable patch was released 10 days ago, and installation is scheduled for day 35. There is no evidence of exploitation or a stricter applicable deadline. Under the PCI DSS v4.0.1 defined approach, which assessment is correct?

Accepted Answer

The score is High; the planned installation meets the documented risk-based deadline for this noncritical finding.

Answer

The score is Critical, so the scheduled installation exceeds the mandatory one-month patching window.

Answer

The score is High, and every High finding must still be patched within one month of release.

Answer

The score is High, so the affected service must be taken offline until the patch has been installed.

Question 5

Six weeks after a passing periodic external scan by an Approved Scanning Vendor (ASV), a merchant makes a significant change to its Internet-facing payment infrastructure. A separate external vulnerability scan is now required for the change. Which statement accurately describes the personnel requirement for this additional scan?

Accepted Answer

Qualified internal testers are eligible when their organizational independence is established.

Answer

The administrator who implemented the change is eligible if management approves.

Answer

The original ASV must perform the scan because its previous passing report covered the environment.

Answer

A Qualified Security Assessor must perform it because significant changes require assessor-led validation.

Question 6

During a cloud-provider review, the merchant verifies that the provider's current Attestation of Compliance covers the infrastructure service it uses. The responsibility matrix assigns operating-system patching and application-log review to the merchant. The infrastructure team proposes closing those two controls using the provider's attestation. What evidence is still needed?

Accepted Answer

Records showing that the merchant performs the patching and log reviews assigned to it.

Answer

The provider's full assessment report in place of merchant operating records.

Answer

A contract clause stating that the provider accepts liability for incidents affecting the hosted workloads.

Answer

A provider statement confirming that the same infrastructure supports other merchants with compliant assessments.

Question 7

In an authorized test of a merchant's customer portal, a tester signs in normally and changes an invoice identifier in a request. The application returns another customer's invoice. The request contains no script or SQL syntax, and the response comes from the genuine application. Which diagnosis and repair fit this result?

Accepted Answer

Broken object-level authorization; check the signed-in user's permission for each requested invoice.

Answer

SQL injection; use parameterized queries for invoice lookups.

Answer

Cross-site scripting; encode invoice data appropriately before rendering it in the browser.

Answer

Cross-site request forgery; validate anti-CSRF tokens before returning invoices to an authenticated browser.

Question 8

A retailer has a documented business need to retain full primary account numbers (PANs). Its database sits on non-removable server disks protected by full-disk encryption. PANs have no additional unreadability protection, although support screens display only the last four digits. The design is being assessed against PCI DSS v4.0.1. What is the missing storage control?

Accepted Answer

Render stored PAN unreadable through another permitted method, such as properly managed field-level encryption.

Answer

Require multifactor authentication for support staff who can view masked card numbers.

Answer

Mask every digit on support screens while leaving the full PAN available to the database application.

Answer

Place the disks in a locked enclosure and document that only authorized infrastructure personnel can remove them.

Question 9

Only one Internet-bound flow is approved for payment server PAY-01: TCP port 443 to two specified processor IP addresses. Their hosting subnet also contains unrelated hosts. Name resolution and time synchronization use internal services. The firewall is stateful and already permits return traffic for authorized connections. Select the egress policy that preserves this flow without granting unnecessary access.

Accepted Answer

Permit PAY-01 to the two processor addresses on TCP 443; deny other Internet-bound traffic.

Answer

Allow PAY-01 to any Internet address on TCP 443; block all other ports.

Answer

Allow PAY-01 to the processor addresses on all TCP ports; block other destinations.

Answer

Permit PAY-01 to the processor's entire hosting subnet on TCP 443; deny traffic to other networks.

Question 10

Opening checks at a shop reveal an unfamiliar overlay on one payment terminal and a serial number that does not match the device inventory. No replacement was authorized. The supervisor has access to the incident-response contact and a separate, verified terminal. What should happen before another customer uses the suspect device?

Accepted Answer

Take it out of service, preserve it as evidence, and activate the incident-response process.

Answer

Remove the overlay and reopen the terminal after a successful test payment.

Answer

Factory-reset the terminal, then give the reset device to the incident-response team for examination.

Answer

Record the discrepancy as a possible inventory error and request inspection during the next maintenance visit.

Free CPISI Practice Questions

Domain 1: Background of Payment Security

Question 1

Domain 2: Building and Maintaining a Secure Network and Systems

Question 2

Question 3

Domain 3: Protecting Account Data

Question 4

Question 5

Domain 4: Maintaining a Vulnerability Management Program

Question 6

Question 7

Domain 5: Implementing a Strong Access Control Measures

Question 8

Question 9

Domain 6: Regularly Monitoring and Testing Networks

Question 10

That's 10 of 1,030