Discuss PCI QSA_New_V4 Exam Topic 5 Question 24

What should the assessor verify when testing that cardholder data Is protected whenever It Is sent over open public networks?

AThe security protocol Is configured to accept all digital certificates.

BA proprietary security protocol is used.

CThe security protocol accepts only trusted keys.

DThe security protocol accepts connections from systems with lower encryption strength than required by the protocol.

Suggested Answer: C

Requirement for Secure Transmission:

PCI DSS Requirement 4.1 mandates that cardholder data sent over open public networks must be protected with strong cryptographic protocols. Accepting only trusted keys ensures data integrity and prevents unauthorized access.

Key Validation Practices:

Trusted keys and certificates are verified to ensure authenticity. Using untrusted keys compromises the security of the encrypted communication.

Prohibited Practices:

A/D: Configuring protocols to accept all certificates or lower encryption strength violates PCI DSS encryption guidelines.

B: Proprietary protocols are not inherently compliant unless they meet strong cryptographic standards.

Testing and Verification:

Assessors verify the implementation of trusted keys by examining encryption settings, reviewing certificate chains, and conducting tests to confirm only trusted connections are accepted.

Get Premium QSA_New_V4 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Tiara 15 hours ago

Overall, C feels like the safest option for data protection.

Noah 6 days ago

B sounds good, but proprietary protocols can be limiting.

Izetta 11 days ago

D is definitely wrong. Lower encryption is a no-go.

Sena 16 days ago

A is risky. Accepting all certificates is unsafe.

Nidia 21 days ago

Agreed! C ensures only secure connections.

Domonique 26 days ago

I think C is the best choice. Trusted keys are crucial.

Cory 1 month ago

C covers the essentials. Protecting cardholder data is priority!

Darrin 1 month ago

B seems too limiting. Proprietary protocols can be problematic.

Teddy 1 month ago

D is definitely a no-go. Lower encryption is unsafe.

Garry 2 months ago

A is risky. Accepting all certificates can lead to breaches.

Malcom 2 months ago

Agreed! Without trusted keys, data is vulnerable.

Renay 2 months ago

I think C is the best choice. Trusted keys are crucial.

Margo 2 months ago

Not sure about this... Are we really trusting all these protocols?

Alita 2 months ago

Wait, D sounds risky. Why allow lower encryption?

Valentin 2 months ago

I think B is a bit sketchy, proprietary protocols can be untested.

Julio 3 months ago

A is a bad idea, it opens up too many risks.

Ma 3 months ago

Definitely C! Only trusted keys should be accepted.

Son 3 months ago

D seems off, why allow lower encryption? That's a no-go!

Winifred 3 months ago

I agree with C, gotta keep it tight with trusted keys.

Marcos 3 months ago

Wait, B? A proprietary protocol? Sounds sketchy.

Maira 3 months ago

A is a bad idea, accepting all certs is risky!

Mertie 4 months ago

Definitely C, only trusted keys should be accepted.

Alishia 4 months ago

I feel like option C makes the most sense since it directly relates to ensuring cardholder data is protected. I just hope I remember the details correctly during the exam!

Chauncey 4 months ago

I’m a bit confused about whether a proprietary security protocol is actually a good choice. It seems risky, but I can't recall the specifics.

Jerrod 4 months ago

I remember a practice question that emphasized the importance of not accepting connections from systems with lower encryption strength, so I think that's crucial here too.

Elfrieda 6 months ago

I think the assessor should verify that the security protocol accepts only trusted keys, but I'm not entirely sure if that's the main focus.

PCI QSA_New_V4 Exam - Topic 5 Question 24 Discussion