Discuss PCI QSA_New_V4 Exam Topic 3 Question 2

A retail merchant has a server room containing systems that store encrypted PAN dat

a. The merchant has Implemented a badge access-control system that Identifies who entered and exited the room, on what date, and at what time. There are no video cameras located in the server room. Based on this information, which statement is true regarding PCI DSS physical security requirements?

AThe badge access-control system must be protected from tampering or disabling.

BThe merchant must Install video cameras in addition to the existing access-control system.

CData from the access-control system must be securely deleted on a monthly basis.

DThe merchant must install motion-sensing alarms In addition to the existing access-control system.

Suggested Answer: A

Physical Security Requirements:

PCI DSS Requirement 9.1.1 mandates that physical access control systems (like badge readers) must be protected against tampering or disabling to ensure continuous security.

Current Implementation:

The merchant's badge access-control system provides essential logging of access events but must also be protected against tampering to comply with PCI DSS.

Invalid Options:

B: Video cameras are recommended but not explicitly required if access controls effectively ensure security.

C: Secure deletion of access-control logs is not a PCI DSS requirement; logs must be retained as per retention policies.

D: Motion-sensing alarms are not mandatory under PCI DSS physical security requirements.

Get Premium QSA_New_V4 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Peggie 11 months ago

Motion-sensing alarms? Sounds like overkill to me.

Thea 11 months ago

Monthly deletion of access data? That's a bit much, isn't it?

Tasia 11 months ago

Wait, why do they need cameras? Seems excessive.

Merissa 12 months ago

I agree, A is the right choice!

Maryann 12 months ago

The badge system definitely needs protection from tampering.

Shonda 1 year ago

I vaguely recall something about data retention policies, but I don't think monthly deletion of access logs is a standard requirement, so I'm not sure about C.

Ula 1 year ago

I practiced a similar question about physical security requirements, and I think the focus was on ensuring that access controls are tamper-proof, which makes me lean towards A.

Keith 1 year ago

I'm not entirely sure, but I feel like the requirement for video cameras might not be mandatory if there's already an access control system in place.

Loren 1 year ago

I remember that the PCI DSS emphasizes the importance of protecting access control systems, so I think option A could be correct.

Izetta 1 year ago

I'm not entirely sure about this one. The question is asking about the true statement, but there could be multiple correct answers depending on the specific PCI DSS requirements. I'll need to review the standards more closely to be confident in my response.

Sang 1 year ago

Okay, I've got this. The badge access-control system must be protected from tampering or disabling, since it's the only physical security measure mentioned. The other options don't seem to directly address the requirements based on the information given.

Brent 1 year ago

Hmm, I'm a bit confused here. The question mentions encrypted PAN data, but it's not clear if the access-control system is the only physical security measure in place. I'll need to think this through carefully.

Arthur 1 year ago

This seems like a straightforward question about PCI DSS physical security requirements. I think the key is to focus on the information provided - the merchant has a badge access-control system but no video cameras.

Helga 2 years ago

I'm not sure, but I think installing motion-sensing alarms could also be a good additional security measure.

Wilda 2 years ago

I agree with Germaine. It makes sense to ensure the access-control system is secure to protect the encrypted PAN data.

Jean 2 years ago

Motion-sensing alarms? Nah, that's just asking for trouble. The access-control system is doing its job just fine.

Carin 2 years ago

↳ replying to Jean

B: I agree, adding motion-sensing alarms seems excessive.

Rene 2 years ago

↳ replying to Jean

A: The badge access-control system must be protected from tampering or disabling.

Tambra 2 years ago

Securely deleting the access data every month? Sounds like a lot of unnecessary work. Can't we just let it pile up?

Wilson 2 years ago

↳ replying to Tambra

Annelle: That's right, we need to ensure the protection of encrypted PAN data.

Leonida 2 years ago

↳ replying to Tambra

User 3: No, it's necessary to follow PCI DSS physical security requirements.

Annelle 2 years ago

↳ replying to Tambra

User 2: But wouldn't it be easier to just let it pile up?

Malinda 2 years ago

↳ replying to Tambra

User 1: It's important to securely delete the access data regularly to maintain security.

Germaine 2 years ago

I think the answer is A) The badge access-control system must be protected from tampering or disabling.

Lashandra 2 years ago

Hold up, video cameras in the server room? Isn't that a bit overkill? I mean, the access logs should be enough, right?

Mattie 2 years ago

The badge access-control system definitely needs to be protected from tampering. Can't have anyone messing with that!

Dean 2 years ago

↳ replying to Mattie

D) The merchant must install motion-sensing alarms In addition to the existing access-control system.

Noel 2 years ago

↳ replying to Mattie

A) The badge access-control system must be protected from tampering or disabling.

Jacki 2 years ago

↳ replying to Mattie

B) The merchant must Install video cameras in addition to the existing access-control system.

Merrilee 2 years ago

↳ replying to Mattie

A) The badge access-control system must be protected from tampering or disabling.

PCI QSA_New_V4 Exam - Topic 3 Question 2 Discussion