PCI QSA_New_V4 Exam - Topic 3 Question 3 Discussion

Actual exam question for PCI's QSA_New_V4 exam

Question #: 3
Topic #: 3

[All QSA_New_V4 Questions]

Which statement about the Attestation of Compliance (AOC) is correct?

AThere are different AOC templates for service providers and merchants.

BThe AOC must be signed by both the merchant/service provider and by PCI SSC.

CThe same AOC template is used W ROCs and SAQs.

DThe AOC must be signed by either the merchant/service provider or the QSA/ISA.

Show Suggested Answer

Suggested Answer: A

Attestation of Compliance (AOC):

The AOC is a document that confirms an entity's compliance with PCI DSS requirements. It is signed by the entity (merchant or service provider) and the Qualified Security Assessor (QSA) if a QSA is involved.

Different AOC Templates:

PCI DSS provides distinct templates for service providers and merchants, tailored to their respective roles and responsibilities within the cardholder data environment (CDE).

Invalid Options:

B: PCI SSC does not sign AOCs; they are signed by the merchant/service provider and the QSA.

C: AOCs differ between ROCs and SAQs, so the same template is not universally used.

D: Both the merchant/service provider and the QSA/ISA (Internal Security Assessor) must sign the AOC when applicable.

by Stevie at Feb 07, 2025, 10:05 PM

Limited Time Offer

25%

Off

Get Premium QSA_New_V4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alica

4 months ago

I always thought the same template was used for ROCs and SAQs.

upvoted 0 times

...

Belen

4 months ago

No way, the AOC has to be signed by both parties!

upvoted 0 times

...

Ramonita

4 months ago

Wait, I thought the AOC only needed one signature?

upvoted 0 times

...

Carin

4 months ago

Totally agree, I've seen both types in action.

upvoted 0 times

...

Marla

4 months ago

AOC templates differ for service providers and merchants, that's true.

upvoted 0 times

...

Javier

5 months ago

I think the AOC can be signed by either the merchant or the QSA, but I might be mixing it up with another document.

upvoted 0 times

...

Quiana

5 months ago

I feel like I saw a practice question that mentioned the AOC and ROCs, but I can't remember if they use the same template or not.

upvoted 0 times

...

Kent

5 months ago

I remember something about the AOC needing signatures, but I can't recall if it has to be both parties or just one.

upvoted 0 times

...

Katheryn

5 months ago

I think there are different AOC templates for service providers and merchants, but I'm not entirely sure.

upvoted 0 times

...

Cassi

5 months ago

Ah, this is a tricky one. I remember there being some differences between the AOC requirements for merchants versus service providers, but I can't quite recall the specifics. I'll have to think this through step-by-step to figure out the right answer.

upvoted 0 times

...

Cammy

5 months ago

I think the answer is D - the AOC only needs to be signed by either the merchant/service provider or the QSA/ISA. I'm fairly confident about that, but I'll double-check the details just to be sure.

upvoted 0 times

...

Lajuana

5 months ago

Hmm, I'm a bit unsure about this one. I know the AOC is an important part of PCI compliance, but I can't recall the specifics of the different templates or signing requirements. I'll have to review my notes carefully.

upvoted 0 times

...

Dannie

5 months ago

I'm pretty sure the correct answer is A - there are different AOC templates for service providers and merchants. I remember learning about that in the PCI DSS training.

upvoted 0 times

...

Caren

1 year ago

Haha, the PCI SSC probably has a template for 'The AOC Must Be Signed in Triplicate by the CEO, CFO, and the Family Dog' just to make things more complicated.

upvoted 0 times

...

Beatriz

1 year ago

I thought the AOC had to be signed by both the merchant/service provider and the PCI SSC? This is getting confusing!

upvoted 0 times

Caren

1 year ago

B) The AOC must be signed by both the merchant/service provider and by PCI SSC.

upvoted 0 times

...

Sheron

1 year ago

A) There are different AOC templates for service providers and merchants.

upvoted 0 times

...

Adolph

1 year ago

I agree with Hester, because the AOC is a document that confirms compliance with PCI DSS and it makes sense that it needs to be signed by the merchant/service provider or the QSA/ISA.

upvoted 0 times

...

Rosann

1 year ago

D) makes the most sense to me. The AOC can be signed by either the merchant/service provider or the QSA/ISA, not both.

upvoted 0 times

...

Hester

1 year ago

I disagree, I believe the correct statement is D) The AOC must be signed by either the merchant/service provider or the QSA/ISA.

upvoted 0 times

...

Luis

1 year ago

I'm pretty sure the correct answer is A) - there are different AOC templates for service providers and merchants. It's important to use the right one for your organization.

upvoted 0 times