PCI Exam QSA_New_V4 Topic 3 Question 3 Discussion

Actual exam question for PCI's QSA_New_V4 exam

Question #: 3
Topic #: 3

[All QSA_New_V4 Questions]

Which statement about the Attestation of Compliance (AOC) is correct?

AThere are different AOC templates for service providers and merchants.

BThe AOC must be signed by both the merchant/service provider and by PCI SSC.

CThe same AOC template is used W ROCs and SAQs.

DThe AOC must be signed by either the merchant/service provider or the QSA/ISA.

Show Suggested Answer

Suggested Answer: A

Attestation of Compliance (AOC):

The AOC is a document that confirms an entity's compliance with PCI DSS requirements. It is signed by the entity (merchant or service provider) and the Qualified Security Assessor (QSA) if a QSA is involved.

Different AOC Templates:

PCI DSS provides distinct templates for service providers and merchants, tailored to their respective roles and responsibilities within the cardholder data environment (CDE).

Invalid Options:

B: PCI SSC does not sign AOCs; they are signed by the merchant/service provider and the QSA.

C: AOCs differ between ROCs and SAQs, so the same template is not universally used.

D: Both the merchant/service provider and the QSA/ISA (Internal Security Assessor) must sign the AOC when applicable.

by Stevie at Feb 07, 2025, 10:05 PM

Limited Time Offer

25%

Off

Get Premium QSA_New_V4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Caren

3 months ago

Haha, the PCI SSC probably has a template for 'The AOC Must Be Signed in Triplicate by the CEO, CFO, and the Family Dog' just to make things more complicated.

upvoted 0 times

...

Beatriz

3 months ago

I thought the AOC had to be signed by both the merchant/service provider and the PCI SSC? This is getting confusing!

upvoted 0 times

Caren

3 months ago

B) The AOC must be signed by both the merchant/service provider and by PCI SSC.

upvoted 0 times

...

Sheron

3 months ago

A) There are different AOC templates for service providers and merchants.

upvoted 0 times

...

Adolph

3 months ago

I agree with Hester, because the AOC is a document that confirms compliance with PCI DSS and it makes sense that it needs to be signed by the merchant/service provider or the QSA/ISA.

upvoted 0 times

...

Rosann

4 months ago

D) makes the most sense to me. The AOC can be signed by either the merchant/service provider or the QSA/ISA, not both.

upvoted 0 times

...

Hester

4 months ago

I disagree, I believe the correct statement is D) The AOC must be signed by either the merchant/service provider or the QSA/ISA.

upvoted 0 times

...

Luis

4 months ago

I'm pretty sure the correct answer is A) - there are different AOC templates for service providers and merchants. It's important to use the right one for your organization.

upvoted 0 times