Discuss PCI CPSA Exam Topic 1 Question 2

A vendor discovers that a recent shipment of cards is missing a set. Which of the following responses would you expect in a compliant organization?

AAn immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement

BThe head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days

CA report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police

DAfter an incident review, the VPA, issuer and law enforcement are all notified within 24 hours

Suggested Answer: D

Get Premium CPSA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

Teri 12 months ago

I’m not convinced about D. What if they need more time to assess?

Sanda 12 months ago

Wait, they’d really notify law enforcement in 24 hours? That seems fast!

Gregoria 1 year ago

C seems more realistic, though. Not sure if they’d act that fast.

Ashley 1 year ago

Definitely agree with D, anything less seems risky.

Sophia 1 year ago

I think option D is the best response. Quick action is key!

Cristen 1 year ago

I feel like option C is too passive. If there's a security issue, shouldn't law enforcement be involved right away?

Elmer 1 year ago

I'm a bit uncertain about the roles involved. Does the issuer always handle the police notification, or could it be the vendor too?

Izetta 1 year ago

I remember a practice question where immediate reporting was emphasized, so I feel like option A might be the best choice here.

Jovita 1 year ago

I think option D sounds right because timely communication is crucial in these situations, but I'm not entirely sure if 24 hours is the standard.

Tamesha 1 year ago

Wait, I'm a bit confused. Does the product also need a master product? Or is that not required? I'll have to review the options again.

Loreta 1 year ago

This looks straightforward. I think option A is the correct answer since it uses the "add ns acl" command to deny access to the specific IP address for the required 10-minute duration.

Kristian 1 year ago

Based on our practice questions, I'm leaning towards 4 licenses, but I keep second-guessing some of the process timings.

Ashlyn 1 year ago

I'm not too sure, but I remember something like "Zero-hour" being mentioned in a practice question.

Emerson 1 year ago

This seems straightforward enough. Based on the scenario, the pricing for data security protections in the vendor contracts is likely the least crucial piece of information from a privacy perspective. The more important factors are the data access, liability, and audit rights.

PCI CPSA Exam - Topic 1 Question 2 Discussion