PCI CPSA Exam Questions Instant Access - No Installation Required

Question 1

During an assessment you walk the perimeter of the building with a guard you find an emergency exit door from the facility and ask the guard what is on the other side. The guard can't remember, and so uses their assigned, secure key to open the door and show you a corridor within the facility. What most concerns you about the situation?

AThe exit door should not lead into the facility

BThe exit door should not be capable of being opened from the outside

CThe guard should not have forgotten where the door leads to

DThe guard should have sought permission from their manager before opening the door

Answer : D

Question 2

When must HSA motion detectors generate an alarm event?

AEach time movement is detected

BEach time movement is detected outside of regular business hours

CEach time movement is detected and the access-control system indicates the room is occupied

DEach time movement is detected and the access-control system indicates the room is not occupied

Answer : D

Question 3

For how long must a vendor retain all applicant and employee background information on file?

AFor at least 12 months after termination of the contract of employment

BFor at least 18 months after termination of the contract of employment

CFor at least 24 months after termination of the contract of employment

DIt is not a requirement to store this information beyond termination of the contract

Answer : C

Question 4

Which of the following statements is true about the facility's non-emergency exits?

AThey must be contact-alarm monitored only when card production activities are taking place

BThey must be configured to prevent staff tailgating

CThey may be left unlocked when a guard is present

DThey must be fitted with biometric access-control devices

Answer : B

Question 5

Which of the following statements is true in relation to visitor access badges?

AEach visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee

BEach visitor entering the facility must wear their issued access badge above waist height

CBadges with access-controls must not be issued to visitors

DUnissued visitor access badges must be securely stored

Answer : A

Question 6

An assessor is unsure if log review and interview is sufficient testing for a requirement. Who can best answer this question?

APayment brands

BIssuing banks

CVendor

DPCI SSC

Answer : D

Question 7

During an assessment you ask to see employee records for employees with access to the HS

AThe records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

AEmployee information, including background checks, must be stored for at least seven years

BEmployee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

CThe vendor must retain the background information for at least 18 months after termination of contract

DThe vendor must only retain background information for all current employees, not for those that have been terminated

Answer : A, A

PCI Card Production Security Assessor (CPSA) Qualification CPSA Exam Questions