I85PREP
⌘ K
PCCP study materials
PCCP study resources

PCI Cloud Compliance Professional (PCCP) practice questions

One question at a time. Build your PCCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1PCI DSS Fundamentals and Scope in Cloud Environments

Under PCI DSS, which party is ultimately responsible for ensuring that cardholder data is protected even when storage is outsourced to a cloud provider?

  1. The card brand that issued the payment card
  2. The cloud provider's upstream internet carrier
  3. The merchant or service provider that owns the account data Correct answer.
  4. The acquiring bank that sponsors the merchant

Explanation

PCI DSS responsibility follows the entity that stores, processes, or transmits cardholder data or that can affect its security. Outsourcing infrastructure does not transfer compliance accountability, so the merchant or service provider remains responsible for validating that controls are met. The cloud provider may hold its own attestations, but that does not discharge the customer's obligations.

Question 2PCI DSS Fundamentals and Scope in Cloud Environments

A company runs its payment application on IaaS virtual machines but manages the guest OS, middleware, and application itself. Which description best reflects the division of PCI DSS responsibility in this deployment?

  1. The company is accountable for the full stack, while the provider's controls support but do not replace it Correct answer.
  2. The card brands assign responsibility to whichever party signs the cloud contract
  3. Responsibility ends at the hypervisor, so the company has no duties for host hardening
  4. The provider is accountable for all PCI DSS requirements because it supplies the hardware

Explanation

In IaaS the customer retains responsibility for the entire stack it configures, from guest OS hardening through the application, while the provider is responsible for the physical and virtualization layers it operates. The customer can use the provider's compliance evidence to support its own assessment but cannot delegate its accountability. Scope and obligations are determined by where cardholder data lives and what can affect its security, not by who signs the contract.

Question 3PCI DSS Fundamentals and Scope in Cloud Environments

Which set of elements defines the cardholder data environment (CDE) that must be included in PCI DSS scope?

  1. Only internet-facing systems that accept payment card entries
  2. Only the systems that directly store the primary account number
  3. Only the databases and backups holding cardholder data
  4. Systems that store, process, or transmit account data plus systems that can impact their security Correct answer.

Explanation

The CDE comprises people, processes, and technology that store, process, or transmit account data, together with all systems connected to or that could impact the security of that environment. Connected-to and security-impacting systems therefore fall in scope even if they never touch a PAN. Narrowing scope to only the data store or only internet-facing systems understates the environment.

Question 4PCI DSS Fundamentals and Scope in Cloud Environments

A SaaS payment platform uses a cloud provider's managed database service. Which activity most directly reduces the platform's PCI DSS scope?

  1. Encrypting backups with keys stored on the same database host
  2. Adding a second firewall in front of the application tier
  3. Logging all database queries for twelve months
  4. Tokenizing card numbers so the platform stores only surrogate values Correct answer.

Explanation

Scope reduction comes from eliminating, migrating, or tokenizing account data so the system no longer stores, processes, or transmits a PAN. Tokenization replaces the PAN with a surrogate, which can remove that data store from scope if implemented so the original value cannot be recovered. Encryption and additional firewalls reduce risk but the underlying systems remain in scope because they still handle account data.

Question 5PCI DSS Fundamentals and Scope in Cloud Environments

What does PCI DSS require before an entity may rely on a cloud provider's shared hosting to reduce the number of its own controls?

  1. Written approval from the card brand
  2. A verbal assurance from the provider's account manager
  3. A separate merchant account with the acquiring bank
  4. Documented provider responsibilities and evidence that they are met Correct answer.

Explanation

When controls are shared or delegated, PCI DSS requires clear documentation of which party is responsible for each requirement and evidence that the provider actually meets its responsibilities. This is typically supported by the provider's attestation of compliance or responsibility matrix. Informal assurances, separate merchant accounts, or brand approvals do not substitute for documented and evidenced responsibility.

Question 6PCI DSS Fundamentals and Scope in Cloud Environments

An administrator deploys a cloud-based jump host that has no cardholder data but holds credentials allowing login to CDE servers. How should this jump host be treated for PCI DSS scoping?

  1. In scope because it can impact the security of the CDE Correct answer.
  2. Out of scope if it is managed by the cloud provider
  3. Out of scope because it stores no account data
  4. Out of scope if access is restricted to business hours

Explanation

Systems with privileged access to the CDE can impact its security and therefore fall within scope as connected-to or security-impacting systems. Holding credentials that grant entry to CDE servers makes the jump host part of the assessed environment. Absence of stored account data, provider management, or time-based access restrictions does not remove that security impact.

Question 7PCI DSS Fundamentals and Scope in Cloud Environments

Which cloud architecture change most effectively removes a system from PCI DSS scope?

  1. Migrating card data handling to a validated P2PE or tokenization service Correct answer.
  2. Enabling host-based intrusion detection on the system
  3. Increasing the retention period for audit logs
  4. Moving the system to a private subnet behind a NAT gateway

Explanation

Scope is defined by the presence of account data and the systems that can impact its security. Migrating the data handling to a validated point-to-point encryption or tokenization service can eliminate account data from the system, removing it from scope. Network placement, host monitoring, and log retention improve security but the system still stores, processes, or transmits account data.

Question 8PCI DSS Fundamentals and Scope in Cloud Environments

What is the primary purpose of network segmentation in a cloud CDE?

  1. To replace the need for an annual assessment
  2. To satisfy the requirement for encryption of data at rest
  3. To allow cardholder data to be stored without protection
  4. To reduce the number of systems that must meet PCI DSS requirements Correct answer.

Explanation

Segmentation isolates the CDE so systems outside it are not connected-to and can be excluded from scope, reducing the number of systems subject to PCI DSS. It must be documented, tested, and effective; weak segmentation expands rather than shrinks scope. Segmentation does not substitute for encryption, assessment, or data protection controls.

Question 9PCI DSS Fundamentals and Scope in Cloud Environments

A cloud team claims segmentation excludes a development VPC from scope. Which evidence would best support that claim during an assessment?

  1. An inventory listing the VPC's virtual machines and operating systems
  2. A network diagram showing the VPC name and owner
  3. A statement in the change management policy that segmentation is required
  4. Firewall and security group rules plus penetration test results showing no CDE reachability Correct answer.

Explanation

To rely on segmentation, an entity must show that controls are configured and effective, not merely documented. Rule sets plus testing that demonstrates no connectivity or reachability into the CDE provide that evidence. Diagrams, inventories, and policy statements describe intent but do not prove the segmentation actually works.

Question 10PCI DSS Fundamentals and Scope in Cloud Environments

Which cloud account structure best supports PCI DSS scoping for a merchant's cardholder data environment?

  1. A dedicated account for the CDE with strict identity and network boundaries Correct answer.
  2. A CDE account that shares administrative roles with the corporate IT account
  3. A single shared account for all workloads to simplify billing
  4. A CDE account with public read access to its storage buckets for convenience

Explanation

A dedicated account with tight identity and network boundaries makes the CDE easier to isolate, monitor, and assess, which supports scope accuracy. Sharing accounts, roles, or public access broadens connectivity and can pull additional systems into scope while weakening controls. Billing convenience does not justify mixing CDE and non-CDE workloads.

Question 11PCI DSS Fundamentals and Scope in Cloud Environments

Which statement correctly describes the role of a cloud provider's Attestation of Compliance (AOC) in a customer's PCI DSS program?

  1. It certifies that the customer's workloads are compliant
  2. It provides evidence the provider met its responsibilities, supporting the customer's assessment Correct answer.
  3. It replaces the customer's own responsibility matrix
  4. It removes the customer's obligation to assess connected-to systems

Explanation

A provider's AOC and responsibility matrix are evidence that the provider met the requirements it owns, which the customer can reference when assessing shared controls. They do not certify the customer's own configuration, erase obligations for connected-to systems, or replace the customer's documented responsibility mapping. The customer must still assess the layers it controls.

Question 12PCI DSS Fundamentals and Scope in Cloud Environments

A provider is certified for PCI DSS but the customer misconfigures its managed database to allow public access. What is the compliance outcome?

  1. The provider becomes non-compliant for the customer's configuration
  2. Compliance is unaffected because the database stores no account data
  3. The customer remains compliant because the service is certified
  4. The customer is non-compliant because its configuration violates requirements it owns Correct answer.

Explanation

Certification of a service covers the provider's controls, not the customer's configuration choices. The customer owns configuration of its resources and must meet applicable requirements such as restricting access to cardholder data. A misconfiguration that exposes account data is a customer-side failure regardless of the provider's status.

Question 13PCI DSS Fundamentals and Scope in Cloud Environments

Which practice best maintains accurate PCI DSS scope over time in a dynamic cloud environment?

  1. Reviewing scope only during the annual assessment
  2. Freezing all infrastructure changes after the first assessment
  3. Continuously tracking data flows and asset inventory as workloads change Correct answer.
  4. Relying on the provider to notify the customer of scope changes

Explanation

Cloud environments change frequently, so scope must be tracked continuously through data-flow mapping and asset inventory to catch new systems that store or can impact account data. Annual-only reviews, provider notification, or freezing changes do not keep scope accurate and can leave systems unassessed. Scope accuracy is an ongoing process, not a point-in-time event.

Question 14PCI DSS Fundamentals and Scope in Cloud Environments

How does use of a validated payment page hosted entirely by a third party affect a merchant's typical PCI DSS scope?

  1. It moves the merchant into the provider's assessment
  2. It eliminates all merchant PCI DSS obligations
  3. It requires the merchant to assess the provider's data centers
  4. It can reduce scope to the merchant's own site and connected systems, depending on implementation Correct answer.

Explanation

When the payment page and card data capture are fully handled by a validated third party and the merchant's site cannot impact the security of that data, the merchant's scope may be reduced to its own site and connected systems. The merchant still has obligations such as securing its site and managing any scripts that could affect the payment page. The merchant does not assess the provider's data centers or join the provider's assessment.

Question 15PCI DSS Fundamentals and Scope in Cloud Environments

Which statement about the PCI DSS Self-Assessment Questionnaire (SAQ) in a cloud deployment is accurate?

  1. An SAQ is never acceptable when a cloud provider is involved
  2. The cloud provider selects the SAQ on the customer's behalf
  3. The SAQ chosen depends on the entity's payment channel and how account data is handled Correct answer.
  4. Any entity may complete the shortest SAQ regardless of its environment

Explanation

Eligibility for a given SAQ depends on the entity's payment channel, how it stores, processes, and transmits account data, and whether it has outsourced elements to validated providers. The entity selects the SAQ that matches its actual environment, not the shortest one available. A cloud provider does not choose the customer's SAQ.

Question 16PCI DSS Fundamentals and Scope in Cloud Environments

A merchant stores no cardholder data but its employees can administer a third party's payment page through a management console. What is the most accurate scoping statement?

  1. The merchant is out of scope because it stores no cardholder data
  2. The merchant has scope for the systems and people that can impact the payment page's security Correct answer.
  3. The merchant must assess the third party's entire CDE
  4. The merchant's obligations are limited to physical security of its office

Explanation

Entities that can control or impact how account data is secured, such as administrators of a payment page, have in-scope systems and personnel even without storing the data themselves. Scope covers the merchant's console access and the people and systems that can affect the payment page. The merchant does not assess the third party's full CDE, and physical office security alone is insufficient.

Question 17PCI DSS Fundamentals and Scope in Cloud Environments

Which requirement most directly addresses the need to identify and document in-scope systems and data flows in a cloud CDE?

  1. Maintaining an inventory of system components that are in scope for PCI DSS Correct answer.
  2. Changing default vendor passwords before deployment
  3. Encrypting cardholder data during transmission over open networks
  4. Restricting physical access to the data center

Explanation

PCI DSS requires an inventory of system components that are in scope, kept current and supported by data-flow documentation, which is foundational to accurate scoping in cloud environments. Default password changes, physical access restriction, and transmission encryption are separate controls that protect the environment but do not define its scope. Accurate inventory and data-flow mapping underpin every scoping decision.

Question 18PCI DSS Fundamentals and Scope in Cloud Environments

A company wants to use a cloud provider's managed key service to protect cardholder data at rest. Which consideration is most relevant to PCI DSS scope?

  1. Encryption removes the need to restrict access to the data store
  2. Key management is out of scope because it is a provider service
  3. The key service must be operated by the merchant on its own hardware
  4. Systems and personnel that can access the keys can impact the security of the data and may be in scope Correct answer.

Explanation

Key management systems and the people who can administer keys can affect the security of encrypted cardholder data, so they are typically connected-to or security-impacting and fall in scope. Encryption does not remove the need to restrict access to the data store. Whether the provider or merchant operates the service, the ability to affect key security determines scope.

Question 19PCI DSS Fundamentals and Scope in Cloud Environments

What is the main reason a merchant should document data flows between its cloud workloads and any third-party payment services?

  1. To prove the cloud provider is responsible for all controls
  2. To determine which card brand rules apply to refunds
  3. To satisfy billing reconciliation requirements
  4. To establish where account data moves and which systems are therefore in scope Correct answer.

Explanation

Data-flow documentation shows where account data is stored, processed, and transmitted, which is the basis for identifying in-scope systems and connected-to systems. It is a scoping tool rather than a billing, provider responsibility, or card brand refund exercise. Without accurate flows, scope conclusions cannot be defended.

Question 20PCI DSS Fundamentals and Scope in Cloud Environments

Which scenario best illustrates scope creep in a cloud environment?

  1. A CDE account restricts inbound traffic to known management hosts
  2. A non-CDE logging account receives replicated CDE logs and gains network access to the CDE Correct answer.
  3. A CDE account stores only tokenized values instead of PANs
  4. A CDE account uses a dedicated identity provider group

Explanation

Scope creep occurs when systems outside the intended boundary become connected-to or security-impacting, pulling them into scope. A logging account that receives CDE logs and can reach the CDE now affects CDE security and must be assessed. Restricted traffic, dedicated identity groups, and tokenization all support tighter scope rather than expanding it.

Question 21PCI DSS Fundamentals and Scope in Cloud Environments

A service provider offers a multi-tenant SaaS platform where tenants configure their own users and integrations. How should PCI DSS responsibility typically be divided?

  1. Responsibility is undefined until a breach occurs
  2. The SaaS provider is responsible for all tenant configuration choices
  3. The tenant is responsible for the provider's underlying infrastructure
  4. The provider secures the platform and the tenant is responsible for its own configuration and use Correct answer.

Explanation

In multi-tenant SaaS, the provider is responsible for the security of the platform it operates, while tenants remain responsible for how they configure users, integrations, and data handling within their instance. Tenants do not become responsible for the provider's infrastructure, and the provider cannot own tenant configuration decisions. Responsibility should be documented in advance, not determined after an incident.

Question 22PCI DSS Fundamentals and Scope in Cloud Environments

Which action best demonstrates that a cloud CDE boundary is being actively maintained rather than assumed?

  1. Reviewing the original architecture diagram each year
  2. Relying on the provider's certification to confirm the boundary
  3. Regularly testing segmentation controls and reconciling them against the current asset inventory Correct answer.
  4. Restricting scope discussions to the security team

Explanation

Boundaries must be verified against reality, which means testing segmentation controls and reconciling them with the current inventory as workloads change. Annual review of a stale diagram, reliance on provider certification, or limiting scope discussions to one team does not confirm the boundary still holds. Active maintenance requires ongoing testing and reconciliation.

Question 23PCI DSS Fundamentals and Scope in Cloud Environments

A merchant uses a cloud load balancer that terminates TLS for its e-commerce site but never sees cardholder data because payment fields post directly to a validated provider. How is the load balancer typically treated?

  1. In scope only if it stores logs containing PANs
  2. Potentially out of scope for account data, but still assessed if it can impact the payment page's security Correct answer.
  3. In scope as part of the CDE because it handles web traffic
  4. Automatically out of scope with no further review

Explanation

Systems that never store, process, or transmit account data are not automatically in the CDE, but they may still be in scope if they can impact the security of the payment page, for example by serving scripts or redirects. The correct approach is to evaluate whether the load balancer can affect how the payment page is delivered and secured. Automatic exclusion or inclusion without analysis is inaccurate.

Question 24PCI DSS Fundamentals and Scope in Cloud Environments

Which statement about encryption and PCI DSS scope is correct?

  1. Encrypting account data always removes the system from scope
  2. Encrypted account data still requires the storing system to meet applicable requirements Correct answer.
  3. Encryption is only required for data in transit
  4. Encryption eliminates the need for access control

Explanation

Encryption protects account data but a system that stores encrypted account data still stores account data and remains subject to applicable requirements, including key management and access control. Encryption does not automatically remove scope, is required for stored data as well as data in transit, and never replaces access control. Scope reduction comes from removing or tokenizing the data, not from encrypting it in place.

Question 25PCI DSS Fundamentals and Scope in Cloud Environments

What is the most appropriate way to treat a cloud-based CI/CD pipeline that can deploy code to CDE servers but never handles account data itself?

  1. Include it because it can impact the security of the CDE through deployed code Correct answer.
  2. Include it only during the annual assessment window
  3. Exclude it if the provider manages the pipeline
  4. Exclude it because it never stores account data

Explanation

A pipeline that can push code to CDE servers can alter the security posture of the CDE and therefore falls in scope as a security-impacting system. The absence of stored account data, provider management, or timing of assessment does not remove that impact. Access controls, change management, and monitoring should apply to the pipeline accordingly.

Question 26PCI DSS Fundamentals and Scope in Cloud Environments

Under PCI DSS, which element defines the cardholder data environment (CDE) itself, as opposed to systems that merely connect to or support it?

  1. Only the database tier that persists primary account numbers at rest
  2. Only the payment application servers that perform authorization of card transactions in real time
  3. Systems that store, process, or transmit account data, together with systems directly connected to or that could impact the security of those systems Correct answer.
  4. Any system on the same virtual network as the payment application, regardless of function

Explanation

PCI DSS defines the CDE as the people, processes, and technology that store, process, or transmit account data, plus all systems directly connected to or that could impact the security of that environment. Connected-to and security-impacting systems are therefore part of the CDE, not a separate category outside it. Narrowing the CDE to a single tier or application understates scope.

Question 27PCI DSS Fundamentals and Scope in Cloud Environments

A retailer uses a public cloud IaaS provider. Which statement best describes how the provider's PCI DSS validation affects the retailer's own compliance obligations?

  1. It removes the need for the retailer to document data flows between its cloud workloads and payment systems
  2. It exempts the retailer from annual network segmentation testing of its own virtual networks
  3. It fully transfers responsibility for the retailer's workloads to the provider once the provider's AOC is published
  4. It confirms controls the provider operates, while the retailer remains accountable for its own configuration and for validating its CDE Correct answer.

Explanation

A cloud provider's PCI DSS validation covers the infrastructure and services the provider operates, and customers rely on it for those controls. The customer still owns the security of its own workloads, configurations, and scoping decisions. Compliance is shared, not transferred, so customer-side validation and documentation continue.

Question 28PCI DSS Fundamentals and Scope in Cloud Environments

A merchant contracts a third-party payment processor that hosts the entire payment page on its own domain, and the merchant's site never receives, transmits, or stores account data. How should the merchant treat this arrangement when determining PCI DSS scope?

  1. The merchant must perform quarterly internal vulnerability scans of the processor's payment page to satisfy its own scanning requirement
  2. The merchant should confirm the processor's PCI DSS validation and address the applicable SAQ for merchants that fully outsource payment capture Correct answer.
  3. The merchant has no PCI DSS obligations of any kind because it never touches card data
  4. The merchant must include the processor's hosting infrastructure in its own CDE because the payment page is presented to its customers

Explanation

When payment capture is fully outsourced to a validated third party and the merchant's systems neither receive nor store account data, the merchant's scope is greatly reduced. The merchant should verify the processor's PCI DSS compliance and complete the self-assessment questionnaire intended for merchants that fully outsource payment processing. Some obligations, such as policy and third-party management, still apply.

Question 29PCI DSS Fundamentals and Scope in Cloud Environments

A cloud team asserts that a development VPC is outside PCI DSS scope because it is separated from production by security groups. Which piece of evidence most directly supports that assertion during a assessment?

  1. Documented segmentation testing confirming that traffic from the development VPC cannot reach the CDE and that the boundary is enforced Correct answer.
  2. An inventory listing showing that no production database instances are deployed in the development VPC
  3. A statement in the change management policy that developers are not permitted to store card data locally
  4. A network diagram showing that the development VPC and the CDE share the same account and VPC peering connection

Explanation

Exclusion of an environment from scope depends on demonstrated, enforced separation rather than topology diagrams or policy statements. Segmentation testing that shows traffic cannot cross the boundary provides the evidence assessors expect. Without such testing, the environment is generally treated as connected to the CDE.

Question 30PCI DSS Fundamentals and Scope in Cloud Environments

A company stores account data encrypted in a cloud object store and holds the encryption keys in a separate managed key service. Which statement about the effect of this encryption on PCI DSS scope is most accurate?

  1. Encryption removes the object store and key service from scope because the data is unreadable at rest
  2. Encryption removes the object store from scope only if the keys are stored in the same account as the data
  3. Encryption reduces the risk of data disclosure but does not by itself remove the object store or key management systems from scope Correct answer.
  4. Encryption removes scope only when the cloud provider's AOC explicitly names the customer's bucket as encrypted

Explanation

PCI DSS scope is driven by where account data is stored, processed, or transmitted and by systems that can impact its security. Encryption is a protective control that can reduce risk and, under some interpretations, limit exposure, but the systems holding the data and the keys generally remain in scope. Key management systems are themselves security-impacting and are assessed.

Question 31Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Under the PCI DSS v4.0 shared responsibility model, which entity is accountable for validating that the cardholder data environment of a merchant using a cloud IaaS provider meets all applicable requirements?

  1. The cloud provider, because it owns the underlying physical infrastructure
  2. The acquiring bank, because it sponsors the merchant into the card brands
  3. The merchant, because the merchant defines and operates its own cardholder data environment Correct answer.
  4. The payment brand, because it publishes the PCI DSS standard

Explanation

PCI DSS obligations attach to every entity that stores, processes, or transmits cardholder data or can affect its security. A cloud provider's compliance covers only the infrastructure layer it controls; the merchant must still validate its own configuration, access management, and application controls. Outsourcing hardware does not transfer compliance accountability.

Question 32Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A SaaS vendor states in its contract that it is 'PCI DSS compliant.' What must a merchant do before relying on that statement for its own compliance documentation?

  1. Request the vendor's internal vulnerability scan output for the past quarter
  2. Accept the statement because contractual compliance claims are binding under PCI DSS
  3. Confirm the vendor is listed as a payment brand acquirer
  4. Obtain and review the vendor's current Attestation of Compliance and the scope of the assessment Correct answer.

Explanation

PCI DSS requires entities to manage their service providers through written agreements and to monitor their compliance status. The AOC and the underlying Report on Compliance or SAQ define which requirements and system components were actually assessed. A marketing statement alone does not establish scope or currency of the assessment.

Question 33Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which document does a service provider at PCI DSS validation level 1 typically furnish to demonstrate the results of its annual assessment?

  1. A completed self-assessment questionnaire signed by the provider's CEO
  2. A penetration test letter issued by a qualified security assessor
  3. A Report on Compliance with the corresponding Attestation of Compliance Correct answer.
  4. A SOC 2 Type I report covering the security trust services criteria

Explanation

Level 1 service providers are assessed by a Qualified Security Assessor, producing a Report on Compliance that details how each requirement was met. The Attestation of Compliance is the summary form signed by the assessor and the provider. Customers rely on both to understand scope and results.

Question 34Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A merchant stores cardholder data in a cloud object storage bucket. Which statement best describes the division of PCI DSS responsibility for that data?

  1. Responsibility is split evenly and jointly for every requirement touching the bucket
  2. The provider is responsible for encryption of the objects because it supplies the storage service
  3. The merchant is responsible for physical media destruction because it owns the data
  4. The provider secures the physical media, while the merchant controls bucket permissions, encryption keys, and access logging Correct answer.

Explanation

In IaaS and PaaS models the provider secures facilities, hardware, and the hypervisor, while the customer configures logical controls such as identity, encryption, and logging. PCI DSS requirement 3 and requirement 10 obligations for the stored data therefore remain with the merchant. Joint responsibility does not mean shared liability for each individual control.

Question 35Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which PCI DSS v4.0 requirement most directly obligates an entity to establish written agreements with its service providers?

  1. Requirement 12.8, which addresses management of service providers Correct answer.
  2. Requirement 6.3, which addresses bespoke and custom software security
  3. Requirement 11.3, which addresses vulnerability scanning
  4. Requirement 9.5, which addresses physical media protection

Explanation

Requirement 12.8 covers service provider management, including written agreements that acknowledge the provider's PCI DSS responsibility and specify which requirements the provider meets. The other requirements address technical controls that may be relevant to a provider relationship but do not impose the agreement obligation itself.

Question 36Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A provider's AOC states that its assessment excluded a specific managed service the merchant uses to process cardholder data. What is the most appropriate response by the merchant?

  1. Conclude that the excluded service is the merchant's responsibility only if the merchant owns the hardware
  2. Ask the provider to reissue the AOC with a broader scope but continue using the service unchanged
  3. Treat the excluded service as outside the provider's validated scope and assess or remediate it as part of the merchant's own compliance program Correct answer.
  4. Rely on the AOC anyway because the provider's overall compliance status covers all its services

Explanation

An AOC is meaningful only within the scope it describes. If a service the merchant relies on was excluded, the merchant cannot claim that control is covered by the provider's validation. The merchant must either obtain a broader assessment or address the gap within its own cardholder data environment controls.

Question 37Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which of the following is a legitimate reason a service provider's PCI DSS scope may be narrower than a customer expects?

  1. The provider accepts card payments only in a single country
  2. The provider has fewer than 100 employees and therefore qualifies for reduced requirements
  3. The provider uses network segmentation to isolate the cardholder data environment from other services Correct answer.
  4. The provider's customers are all validated at level 4

Explanation

Segmentation that is validated during the assessment can legitimately reduce the cardholder data environment and thus the assessed scope. Headcount, customer validation level, and geography do not by themselves reduce PCI DSS scope. Customers must confirm that the specific service they use falls inside the segmented scope.

Question 38Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

In a shared responsibility discussion, which control area is normally retained by the cloud provider under an IaaS model?

  1. Configuration of the host-based intrusion detection agent on the guest operating system
  2. Physical security of the data center housing the servers Correct answer.
  3. Management of application user accounts in the merchant's payment application
  4. Retention schedule for cardholder data stored in the merchant's database

Explanation

Facility access controls and physical security of the data center are provider responsibilities under IaaS because the customer has no physical access to those assets. Guest operating system agents, application accounts, and data retention decisions sit with the customer. This allocation follows control of the layer, not ownership of the data.

Question 39Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A merchant wants to reduce its PCI DSS scope by using a provider's tokenization service so that its systems never store the primary account number. Which condition is essential for the scope reduction to hold?

  1. The tokenization implementation and its segmentation must be validated so that the merchant's environment truly cannot access the account number Correct answer.
  2. The tokens must be reversible only by the acquiring bank
  3. The provider must be validated at level 1 regardless of how the service is implemented
  4. The merchant must still store the account number in a backup location for reconciliation

Explanation

Scope reduction depends on the account data being genuinely absent or unreachable in the merchant environment, and on segmentation being confirmed during assessment. Using a tokenization service without validated isolation can leave the account number in scope through other paths. The provider's validation level alone does not guarantee the merchant's scope outcome.

Question 40Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which statement about a service provider's responsibility to notify customers of a breach affecting cardholder data is accurate?

  1. Notification is owed only to the acquiring bank, never to the merchant customer
  2. The obligation should be defined in the written agreement, including notification timelines and points of contact Correct answer.
  3. Notification is prohibited until the payment brands issue a public statement
  4. Notification is unnecessary if the provider is PCI DSS compliant at the time of the incident

Explanation

PCI DSS requirement 12.8 expects written agreements to establish the provider's responsibility for reporting incidents that could affect customer data. Compliance at the time of an incident does not eliminate the duty to notify affected parties. Clear timelines and contacts make the obligation operationally usable.

Question 41Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

An entity is evaluating a provider's AOC and notices the assessment date is 20 months old. How should this affect reliance on the document?

  1. The document can be used only if the provider is also ISO 27001 certified
  2. The entity should seek evidence of a more recent assessment, since PCI DSS validation is expected to be maintained annually Correct answer.
  3. The document is acceptable if the provider has not changed its logo since the assessment
  4. The document remains valid indefinitely because PCI DSS certifications do not expire

Explanation

PCI DSS validation is refreshed through annual assessments, and a stale AOC may not reflect the provider's current controls or scope. Requirement 12.8 expects entities to monitor their providers' compliance status on an ongoing basis. Requesting current evidence is the appropriate response.

Question 42Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which activity best demonstrates ongoing monitoring of a service provider's PCI DSS compliance rather than a one-time check?

  1. Collecting a signed AOC once at contract signing and filing it
  2. Asking the provider's sales team to confirm compliance verbally each quarter
  3. Reviewing the provider's updated AOC each year and tracking remediation of any noted gaps Correct answer.
  4. Checking whether the provider appears on a payment brand's list of validated providers once

Explanation

Requirement 12.8 expects monitoring to be ongoing, which means refreshing evidence and following up on identified deficiencies. A single document collected at onboarding can quickly become outdated. Tracking remediation closes the loop between evidence review and risk management.

Question 43Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A merchant uses a payment page hosted entirely by a PCI-validated provider, and the merchant's own site only redirects customers to that page. Which SAQ is most likely applicable, assuming all other eligibility criteria are met?

  1. SAQ D for service providers
  2. SAQ P2PE
  3. SAQ A Correct answer.
  4. SAQ C-VT

Explanation

SAQ A applies to merchants that fully outsource cardholder data functions to validated providers, for example through a redirect or iframe where the merchant's systems do not capture account data. SAQ D for service providers applies to providers themselves, and SAQ C-VT applies to virtual terminal environments. Eligibility must still be confirmed against all SAQ criteria.

Question 44Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which statement correctly characterizes the relationship between a provider's PCI DSS compliance and a customer's own PCI DSS compliance?

  1. The provider's compliance automatically extends to the customer's environment
  2. The customer's compliance automatically extends to the provider's environment
  3. Neither party needs to validate if the other has a current AOC
  4. The provider's compliance supports but does not replace the customer's obligation to secure its own systems and configurations Correct answer.

Explanation

Each entity validates the controls it is responsible for. A provider's AOC is evidence about the provider's environment, and the customer must still meet requirements for its own systems, applications, and processes. Compliance does not propagate automatically in either direction.

Question 45Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A provider offers a managed encryption service and states that customers need not perform key management. What should the customer verify in the provider's documentation?

  1. Whether the provider's employees have signed nondisclosure agreements
  2. Whether the provider's data centers are located in the same country as the customer
  3. Whether the provider offers a discount for multiyear contracts
  4. Whether key management controls are included in the provider's assessed scope and which requirements the provider meets Correct answer.

Explanation

When a provider claims to absorb a control, the customer must confirm that control is inside the assessed scope and that the corresponding PCI DSS requirements are addressed. Otherwise the customer may have an unaddressed key management gap. Nondisclosure agreements, geography, and pricing do not establish PCI DSS coverage.

Question 46Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which of the following best describes why a service provider's AOC may list fewer requirements as the customer's responsibility than the customer assumed?

  1. The AOC transfers all legal liability for cardholder data to the payment brands
  2. The AOC replaces the need for a written services agreement
  3. The AOC is a marketing document with no defined structure
  4. The AOC records which requirements the provider meets and which the customer must meet, based on the assessed scope of the service Correct answer.

Explanation

The AOC includes a section describing the provider's responsibilities and those the customer retains, tied to the assessed scope. This helps customers understand where their own controls must apply. It does not shift liability to the brands or substitute for a contract.

Question 47Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A merchant discovers that its cloud provider suffered an intrusion that may have exposed the merchant's stored cardholder data. Which action is most consistent with the merchant's PCI DSS obligations?

  1. Publicly disclose the incident immediately without internal assessment
  2. Activate its incident response plan, investigate the merchant-controlled systems, and coordinate with the provider under the agreed notification terms Correct answer.
  3. Wait for the provider to complete its own investigation before taking any internal action
  4. Terminate the provider contract before determining whether data was affected

Explanation

Requirement 12.10 requires an incident response plan that can be executed promptly, and the merchant must determine the impact on its own environment. Coordinating with the provider under the contract terms is part of that response. Deferring all action or acting without assessment undermines the response.

Question 48Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which statement about the use of a shared hosting provider for a merchant's e-commerce site is most accurate under PCI DSS v4.0?

  1. The hosting provider's AOC covers the merchant's application code automatically
  2. The merchant must ensure the hosting environment is included in an appropriate assessment and that its own application and configuration controls are validated Correct answer.
  3. The merchant is exempt from validation because hosting is outsourced
  4. Only the hosting provider needs to be validated, and the merchant needs no documentation

Explanation

Shared hosting places infrastructure controls with the provider but leaves application, configuration, and access controls with the merchant. Both layers must be covered by appropriate validation. An AOC for the hosting environment does not assess the merchant's own code or settings.

Question 49Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

Which element is most important to include in a written agreement with a service provider to satisfy PCI DSS requirement 12.8?

  1. A clause requiring the provider to purchase cyber insurance
  2. A commitment by the provider to use only open source software
  3. A guarantee that the provider will never experience a security incident
  4. Acknowledgment that the provider is responsible for the security of cardholder data it possesses and a description of the requirements it meets Correct answer.

Explanation

Requirement 12.8 expects agreements to state the provider's acknowledgment of responsibility for cardholder data and to identify which PCI DSS requirements the provider manages. This gives the customer a documented basis for its own scope decisions. Insurance, software sourcing, and absolute security guarantees are not the required elements.

Question 50Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)

A merchant's QSA asks how the merchant verified that a provider's segmentation actually keeps the merchant's data out of the provider's broader corporate network. What is the strongest evidence?

  1. A statement in the provider's marketing brochure describing network isolation
  2. The provider's general statement that it follows industry best practices
  3. An email from the provider's account manager confirming isolation
  4. Segmentation testing results included in the provider's assessment documentation covering the relevant service Correct answer.

Explanation

Segmentation claims must be supported by testing performed during the assessment, because untested segmentation cannot be relied upon to reduce scope. Marketing materials, account manager emails, and generic best-practice statements are not evidence of tested isolation. The customer should confirm the tested scope matches the service it uses.