I85PREP
⌘ K
PCA CPP study materials
PCA CPP study resources

PCA CPP practice questions

One question at a time. Build your PCA CPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Coding Guidelines and Regulatory Compliance

Under the PCI DSS scope-reduction principle, which approach most effectively limits the systems that store, process, or transmit cardholder data?

  1. Segmenting the corporate LAN from the DMZ with a firewall
  2. Tokenizing the PAN at the point of capture so downstream systems never see it Correct answer.
  3. Encrypting the PAN in every database that receives it
  4. Logging all access to the cardholder data environment for review

Explanation

Tokenization replaces the PAN with a surrogate value, so systems handling only tokens fall outside cardholder data scope entirely. Encryption and segmentation reduce risk but the data remains present, keeping those systems in scope. Logging supports monitoring rather than scope reduction.

Question 2Coding Guidelines and Regulatory Compliance

Which data element may be stored after authorization, provided it is rendered unreadable?

  1. The full magnetic stripe track data
  2. The primary account number Correct answer.
  3. The card verification code
  4. The PIN block

Explanation

PCI DSS permits retention of the PAN after authorization if it is protected per the standard, for example by strong cryptography. Sensitive authentication data such as full track data, the CVV2, and PIN blocks must never be stored post-authorization even when encrypted.

Question 3Coding Guidelines and Regulatory Compliance

A merchant wants to reduce PCI DSS scope by outsourcing card data capture to a payment page hosted by a PCI-validated provider. Which condition is essential for this to work?

  1. The merchant must still store the PAN in its order management system
  2. The provider must be located in the same country as the merchant
  3. The merchant's website must never receive or relay the cardholder data Correct answer.
  4. The merchant must run quarterly internal vulnerability scans of the provider

Explanation

Scope reduction through hosted payment pages depends on the merchant's environment being fully out of the card data flow. If the merchant site receives, relays, or scripts around the card fields, those systems re-enter scope. Provider location and internal scanning of the provider are not the determining factors.

Question 4Coding Guidelines and Regulatory Compliance

Which statement correctly describes the role of a Qualified Security Assessor (QSA) in the compliance process?

  1. A QSA grants the entity its PCI DSS compliance certificate directly
  2. A QSA writes the entity's security policies on the entity's behalf
  3. A QSA performs the on-site assessment and documents findings for a Report on Compliance Correct answer.
  4. A QSA certifies that an entity will never suffer a data breach

Explanation

A QSA is an independent assessor who evaluates controls against PCI DSS and produces the Report on Compliance. Acquiring banks or payment brands, not the assessor, make the formal compliance determination. Assessors do not guarantee breach immunity or author client policies.

Question 5Coding Guidelines and Regulatory Compliance

An entity is completing a Self-Assessment Questionnaire. Which statement about SAQ selection is accurate?

  1. The SAQ replaces the need for any network segmentation controls
  2. Any entity may choose the shortest SAQ to minimize effort
  3. The SAQ must match the entity's actual card data environment and business model Correct answer.
  4. The SAQ is only required for entities processing more than one million transactions

Explanation

Each SAQ is designed for a specific way of handling card data, so selection must reflect the real environment and business model. Choosing a shorter questionnaire that does not match actual data flows produces an invalid attestation. Transaction volume thresholds and segmentation are separate considerations.

Question 6Coding Guidelines and Regulatory Compliance

Which requirement addresses the secure development of in-house payment applications?

  1. Requiring annual penetration testing of the corporate email system
  2. Training developers in secure coding and reviewing code for vulnerabilities before release Correct answer.
  3. Encrypting backups of the cardholder data environment
  4. Restricting developer access to production data only during business hours

Explanation

PCI DSS requires secure coding practices, developer training, and code review or testing to address vulnerabilities before applications are released. The other options describe access control, testing scope, and data protection controls rather than secure development.

Question 7Coding Guidelines and Regulatory Compliance

During a compliance review, an auditor finds that wireless access points near the cardholder data environment broadcast default SSIDs and use vendor-supplied keys. Which PCI DSS expectation is being violated?

  1. Wireless access points must be placed on the DMZ only
  2. Wireless networks must be entirely absent from the cardholder data environment
  3. Wireless traffic must be unencrypted to allow inspection
  4. Default wireless settings must be changed before deployment and keys managed securely Correct answer.

Explanation

PCI DSS requires changing default wireless settings such as SSIDs and encryption keys, and managing keys securely. Wireless is permitted when properly configured and segmented. Placing access points only in a DMZ or disabling encryption is not the requirement.

Question 8Coding Guidelines and Regulatory Compliance

What is the primary purpose of the PCI DSS Attestation of Compliance (AOC)?

  1. To list every vulnerability found during the last scan
  2. To serve as a contract between the merchant and its customers
  3. To replace the Report on Compliance for large merchants
  4. To document the entity's compliance status and scope for the acquiring bank Correct answer.

Explanation

The AOC is a declaration summarizing the results of the assessment and the scope of the environment, provided to the acquiring bank or payment brand. It is not a vulnerability listing, a customer contract, or a substitute for the full report.

Question 9Coding Guidelines and Regulatory Compliance

A service provider stores cardholder data for multiple clients in a shared environment. Which requirement most directly applies to protecting client data from other clients?

  1. The provider must delete all client data at the end of each business day
  2. The provider must implement controls ensuring client data is segregated and access is restricted Correct answer.
  3. The provider must publish its clients' names in the AOC
  4. Each client must be issued its own physical server

Explanation

Multi-tenant service providers must ensure that one client cannot access another client's cardholder data, typically through logical segregation and access restrictions. Dedicated physical hardware and daily deletion are not required, and client names need not be disclosed.

Question 10Coding Guidelines and Regulatory Compliance

Which scenario best illustrates a compensating control under PCI DSS?

  1. Deferring a requirement until the next assessment cycle
  2. Skipping a requirement because the entity is small
  3. Applying a requirement to only half of the in-scope systems
  4. Replacing a required firewall with a documented alternative that meets the control objective Correct answer.

Explanation

A compensating control is an alternative measure that satisfies the intent of a requirement when the original control cannot be met, and it must be documented with a defined objective and risk analysis. It is not a waiver, deferral, or partial application.

Question 11Coding Guidelines and Regulatory Compliance

Which practice best supports compliance with the requirement to restrict access to cardholder data by business need to know?

  1. Granting temporary access without any approval record
  2. Assigning roles based on job function and reviewing privileges regularly Correct answer.
  3. Granting all administrators full access to simplify troubleshooting
  4. Sharing a single administrative account among the operations team

Explanation

Need-to-know access is achieved through role-based assignment, least privilege, and periodic review of entitlements. Shared accounts and unapproved or overly broad access violate the principle and undermine accountability.

Question 12Coding Guidelines and Regulatory Compliance

An entity discovers that a developer copied a production database containing PANs to a test server. Which compliance concern is most directly raised?

  1. Test servers must be physically located in the data center
  2. Test data must be de-identified or masked before use outside production Correct answer.
  3. Test data must be encrypted with a shared team key
  4. Developers must never access any production system

Explanation

PCI DSS requires that production cardholder data not be used for testing or development; if data is used, it must be protected or de-identified. Copying live PANs to test systems expands scope and breaches this requirement. Physical location, total prohibition of access, and shared keys do not address the issue.

Question 13Coding Guidelines and Regulatory Compliance

Which element is required in a PCI DSS incident response plan?

  1. Automatic deletion of all logs after an incident
  2. Clearly defined roles and communication procedures for responding to a breach Correct answer.
  3. A list of competitors' security incidents
  4. A guarantee that no incident will recur

Explanation

An incident response plan must define responsibilities, escalation paths, and communication procedures so the entity can respond effectively. It cannot guarantee prevention and should not destroy evidence such as logs.

Question 14Coding Guidelines and Regulatory Compliance

An entity wants to use network segmentation to reduce PCI DSS scope. Which evidence best demonstrates that segmentation is effective?

  1. A policy stating that segmentation is required
  2. Penetration testing and configuration review confirming that out-of-scope systems cannot access or influence the cardholder data environment Correct answer.
  3. Annual training records for the network team
  4. A network diagram showing the intended design

Explanation

Segmentation must be verified through testing and configuration review, not merely documented. Diagrams and policies describe intent, while testing demonstrates that controls actually prevent unauthorized paths into the cardholder data environment.

Question 15Coding Guidelines and Regulatory Compliance

Which statement about the relationship between PCI DSS and other regulations is correct?

  1. PCI DSS compliance automatically satisfies all privacy laws
  2. PCI DSS is a contractual standard that may overlap with but does not replace legal requirements Correct answer.
  3. PCI DSS applies only to government agencies
  4. PCI DSS supersedes national data protection legislation

Explanation

PCI DSS is enforced through contracts among payment brands, acquirers, and merchants, and it operates alongside laws such as privacy and data protection statutes. Compliance with one does not automatically satisfy the other, and the standard is not limited to public bodies.

Question 16Coding Guidelines and Regulatory Compliance

A merchant accepts card-present transactions and stores paper receipts containing the full PAN and expiration date in a locked cabinet. Which requirement applies?

  1. The expiration date must be printed in full on every receipt
  2. Paper receipts must be scanned into a database for audit purposes
  3. Paper records are out of scope because they are not electronic
  4. Stored paper records containing cardholder data must be protected and access restricted Correct answer.

Explanation

PCI DSS scope includes cardholder data in any form, including paper. Paper records containing the PAN must be secured and access limited, and truncation rules apply to printed receipts. Scanning records into a database would increase scope rather than resolve it.

Question 17Coding Guidelines and Regulatory Compliance

Which activity is a required element of the quarterly vulnerability scanning process for an entity subject to PCI DSS?

  1. Performing scans exclusively from inside the internal network
  2. Scanning once per year to align with the assessment
  3. Scanning only the web servers that accept payments
  4. Scanning by an Approved Scanning Vendor and remediating findings before passing Correct answer.

Explanation

External vulnerability scans must be performed quarterly by an Approved Scanning Vendor, and identified vulnerabilities must be remediated and rescanned until a passing result is achieved. Limiting scans to one system, reducing frequency, or scanning only internally does not satisfy the requirement.

Question 18Coding Guidelines and Regulatory Compliance

Which key-management practice aligns with PCI DSS requirements for cryptographic keys protecting cardholder data?

  1. Using the same key indefinitely to avoid re-encryption effort
  2. Storing key-encrypting keys together with the data they protect
  3. Splitting knowledge of key components among custodians and rotating keys periodically Correct answer.
  4. Emailing plaintext keys to administrators for convenience

Explanation

PCI DSS requires key custodians to acknowledge their responsibilities, split knowledge and dual control for key components, and periodic key rotation. Storing keys with the data, transmitting them insecurely, or never rotating them defeats the protection.

Question 19Coding Guidelines and Regulatory Compliance

A company processes card data in a cloud environment. Which responsibility remains with the company even when using a PCI-validated cloud provider?

  1. Managing the provider's hypervisor patching schedule
  2. Validating the provider's underlying physical data centers
  3. Certifying the provider's compliance status to the payment brands
  4. Configuring its own systems and access controls to protect cardholder data Correct answer.

Explanation

Using a compliant cloud provider does not transfer the customer's own configuration, access control, and application security obligations. Physical data center validation, hypervisor patching, and the provider's certification remain the provider's responsibility.

Question 20Coding Guidelines and Regulatory Compliance

Which statement accurately describes the PCI DSS versioning and lifecycle process?

  1. The standard is updated periodically, with new versions introducing revised requirements and effective dates Correct answer.
  2. The standard is fixed and has never been revised since its introduction
  3. Each merchant may choose which historical version to follow indefinitely
  4. New versions apply only to acquirers, not to merchants

Explanation

PCI DSS is revised periodically through a defined lifecycle involving industry feedback, with new versions specifying requirements and effective dates. Entities are expected to migrate to current versions rather than remain on superseded ones, and revisions apply across the payment ecosystem.

Question 21Coding Guidelines and Regulatory Compliance

An entity's firewall rules allow unrestricted inbound traffic from the internet to a server in the cardholder data environment. Which requirement is most directly implicated?

  1. Requiring multi-factor authentication for all website visitors
  2. Retaining firewall logs for at least ten years
  3. Encrypting all internal network traffic between application tiers
  4. Restricting inbound and outbound traffic to that which is necessary for the cardholder data environment Correct answer.

Explanation

PCI DSS requires that firewall and router configurations restrict traffic to only what is necessary for the cardholder data environment. Broad inbound access violates this restriction. Internal encryption, visitor authentication, and a ten-year log retention period are separate or overstated requirements.

Question 22Coding Guidelines and Regulatory Compliance

Which scenario indicates a failure to meet the requirement for protecting stored cardholder data with strong cryptography?

  1. The PAN is stored in plaintext in a reporting database used by finance Correct answer.
  2. The PAN is tokenized and the token maps to a secured vault
  3. The PAN is stored encrypted with a documented, industry-accepted algorithm and managed keys
  4. The PAN is truncated so the full value is not retained

Explanation

Stored cardholder data must be rendered unreadable using strong cryptography with proper key management. Plaintext storage fails this requirement, while encryption, truncation, and tokenization with a secured vault are acceptable approaches.

Question 23Coding Guidelines and Regulatory Compliance

Which practice supports compliance with the requirement to track and monitor all access to cardholder data and network resources?

  1. Disabling logging on high-traffic servers to improve performance
  2. Storing logs only on the systems that generate them
  3. Reviewing logs once every three years
  4. Correlating logs from in-scope systems and reviewing them for anomalies Correct answer.

Explanation

Monitoring requires centralized or correlated logging and regular review so that suspicious activity can be detected. Local-only logs are easily tampered with, disabling logging removes the audit trail, and infrequent review defeats timely detection.

Question 24Coding Guidelines and Regulatory Compliance

An entity cannot meet a specific PCI DSS requirement due to a documented technical constraint and implements an alternative control. What must the documentation include to be defensible?

  1. A statement that the requirement is not applicable to the entity
  2. Confirmation that no cardholder data is present anywhere in the environment
  3. The constraint, the control objective, the alternative control, and evidence that it meets the objective Correct answer.
  4. A note that the gap will be addressed in a future year

Explanation

Compensating control documentation must identify the original requirement and its objective, the identified constraint, the alternative control, and validation that the objective is met. Claiming non-applicability or deferring remediation does not satisfy the requirement.

Question 25Coding Guidelines and Regulatory Compliance

A payment application vendor must demonstrate that its software protects cardholder data. Which framework is designed specifically for validating payment applications used in card-present environments?

  1. The Approved Scanning Vendor program
  2. The Payment Application Data Security Standard evaluation Correct answer.
  3. The Report on Compliance for service providers
  4. The Self-Assessment Questionnaire A

Explanation

Payment applications are evaluated against the Payment Application Data Security Standard, which addresses secure coding and data protection for software used in payment acceptance. SAQ A covers card-not-present merchants, the ROC applies to entities rather than applications, and the ASV program governs scanning.

Question 26Coding Guidelines and Regulatory Compliance

Under the PCI Software Security Framework, which document contains the security requirements a payment software vendor must meet for its product to be validated?

  1. The Payment Card Industry Data Security Standard (PCI DSS) Self-Assessment Questionnaire
  2. The Software Security Requirements for Payment Software (Secure Software Standard) Correct answer.
  3. The Secure Software Lifecycle (Secure SLC) Standard
  4. The PCI PIN Transaction Security (PTS) POI Modular Security Requirements

Explanation

The PCI Software Security Framework consists of the Secure Software Standard, which defines the security requirements payment software must satisfy to be validated, and the Secure SLC Standard, which addresses the vendor's development lifecycle processes. The Secure Software Standard is the module-based document that applies to the software product itself.

Question 27Coding Guidelines and Regulatory Compliance

A payment application vendor wants to demonstrate that its software development practices consistently protect cardholder data across all its products. Which framework component is intended for this purpose?

  1. The Card Production Logical Security Requirements
  2. The Secure Software Lifecycle (Secure SLC) Standard Correct answer.
  3. The Report on Compliance template
  4. The Attestation of Compliance for service providers

Explanation

The Secure SLC Standard is designed to assess and validate a software vendor's development and lifecycle processes, showing that security is built into how the vendor designs, develops, and maintains its products. It complements the product-focused Secure Software Standard.

Question 28Coding Guidelines and Regulatory Compliance

A payment software vendor is preparing for validation under the PCI Software Security Framework. Which activity best aligns with the framework's expectation that security testing is performed on the software before release?

  1. Documenting the software's architecture without executing any security tests
  2. Relying solely on customer-reported defects after deployment to identify vulnerabilities
  3. Conducting penetration testing and vulnerability analysis on the software as part of the development lifecycle Correct answer.
  4. Deferring all security testing to the annual PCI DSS assessment of the vendor's own CDE

Explanation

The Software Security Framework expects vendors to integrate security testing, including vulnerability analysis and penetration testing, into the software development lifecycle so weaknesses are found and remediated before release. Testing is a continuous development activity rather than something deferred to a customer or an unrelated annual assessment.

Question 29Coding Guidelines and Regulatory Compliance

A software vendor subject to the Secure SLC Standard is reviewing how it handles third-party and open-source components in its payment application. Which practice best reflects the framework's expectations for these components?

  1. Removing all third-party components to avoid any dependency on external code
  2. Assuming open-source libraries are inherently secure and exempt from the vendor's security processes
  3. Tracking components and their versions, monitoring for known vulnerabilities, and applying timely patches Correct answer.
  4. Relying on the component supplier's marketing claims instead of verifying security

Explanation

The framework expects vendors to maintain awareness of the third-party and open-source components in their software, monitor them for known vulnerabilities, and remediate promptly. This component inventory and vulnerability management discipline is part of a secure development lifecycle.

Question 30Coding Guidelines and Regulatory Compliance

A payment software vendor's Secure SLC assessment reveals that security requirements are defined at project kickoff but changes to those requirements are never reviewed or approved during development. Which gap does this most directly represent in the vendor's lifecycle controls?

  1. A failure to maintain a component inventory for third-party code
  2. A failure to document the software's architecture
  3. A failure to manage and control changes to security requirements throughout the lifecycle Correct answer.
  4. A failure to conduct penetration testing before release

Explanation

A secure lifecycle requires that security requirements be managed and controlled, including review and approval of changes as the software evolves. If requirements are set once and never revisited, the vendor cannot show that security expectations remain valid and enforced through development.

Question 31ICD-10-CM Diagnosis Coding

A patient is seen for a first-time visit for type 2 diabetes mellitus without complications. Which ICD-10-CM code is reported?

  1. E10.9
  2. R73.09
  3. E11.9 Correct answer.
  4. E11.65

Explanation

Type 2 diabetes mellitus without complications is classified to category E11, and the code E11.9 is used when no complication is documented. E10 codes describe type 1 diabetes, and R73.09 describes abnormal glucose tolerance rather than diabetes.

Question 32ICD-10-CM Diagnosis Coding

In ICD-10-CM, which character position in a code indicates laterality?

  1. The fourth character
  2. The seventh character
  3. The fifth character
  4. The sixth character Correct answer.

Explanation

Laterality is captured at the sixth character position in ICD-10-CM codes that require it, such as codes for injuries and some musculoskeletal conditions. The seventh character is reserved for encounter or episode of care.

Question 33ICD-10-CM Diagnosis Coding

According to ICD-10-CM conventions, what does a code listed in italics and brackets in the Alphabetic Index represent?

  1. A code that must be sequenced first
  2. A manifestation code that cannot be the first-listed diagnosis Correct answer.
  3. A code that is optional and never reported
  4. A code that requires a seventh character

Explanation

In the ICD-10-CM Alphabetic Index, a code shown in italics and brackets is a manifestation code that, per the etiology/manifestation convention, is sequenced after the underlying condition code. It cannot be assigned as the principal diagnosis.

Question 34ICD-10-CM Diagnosis Coding

A patient is admitted with acute systolic heart failure and also has chronic kidney disease stage 3. The physician documents that the heart failure is due to the kidney disease. How are the codes sequenced?

  1. N18.3 only
  2. N18.3 first, then I50.21 Correct answer.
  3. I50.21 first, then N18.3
  4. I50.21 only

Explanation

When a causal relationship is documented between chronic kidney disease and heart failure, the CKD code is sequenced first as the etiology, followed by the heart failure manifestation code. The Index directs I50.21 to be reported as an additional code with the kidney condition.

Question 35ICD-10-CM Diagnosis Coding

Which organization maintains and publishes the ICD-10-CM classification used in the United States?

  1. The WHO alone
  2. The Joint Commission
  3. The AMA
  4. CMS, through the NCHS Correct answer.

Explanation

ICD-10-CM is maintained in the United States by the National Center for Health Statistics within CDC and the Centers for Medicare & Medicaid Services, which co-publish the annual updates. The World Health Organization maintains ICD-10, but the clinical modification is a U.S. product.

Question 36ICD-10-CM Diagnosis Coding

A patient with known asthma presents for an acute exacerbation. The documentation states "acute exacerbation of moderate persistent asthma." Which code is assigned?

  1. J45.31
  2. J45.21 Correct answer.
  3. J45.901
  4. J45.41

Explanation

J45.21 describes mild persistent asthma with acute exacerbation, while moderate persistent asthma with acute exacerbation is J45.41. The documentation specifies moderate persistent with acute exacerbation, so J45.41 is the correct code.

Question 37ICD-10-CM Diagnosis Coding

Under ICD-10-CM coding guidelines, when a patient is seen for a condition that is documented as "rule out" or "suspected," how should the encounter be coded on an outpatient basis?

  1. Code the symptoms or signs that prompted the visit Correct answer.
  2. Assign the rule-out code with a query flag
  3. Code the condition as confirmed
  4. Assign the condition code with a Z03.89

Explanation

In outpatient settings, diagnoses documented as "rule out," "suspected," or "probable" are not coded as confirmed conditions. Instead, codes for the signs or symptoms that prompted the encounter are reported.

Question 38ICD-10-CM Diagnosis Coding

A patient presents with a documented history of a myocardial infarction that occurred two years ago and no current cardiac symptoms. Which code reflects this history?

  1. Z86.79
  2. I25.2 Correct answer.
  3. I25.10
  4. I21.9

Explanation

I25.2, old myocardial infarction, is used when a patient has a history of MI with no current symptoms. I21 codes describe acute MI, and I25.10 describes atherosclerotic heart disease of a native coronary artery without angina.

Question 39ICD-10-CM Diagnosis Coding

Which ICD-10-CM chapter contains codes for hypertensive diseases?

  1. Chapter 4, Endocrine, nutritional and metabolic diseases
  2. Chapter 10, Diseases of the respiratory system
  3. Chapter 9, Diseases of the circulatory system Correct answer.
  4. Chapter 18, Symptoms, signs and abnormal findings

Explanation

Hypertensive diseases are classified in Chapter 9, Diseases of the circulatory system, which includes categories I10 through I16. Respiratory and endocrine chapters cover different body systems.

Question 40ICD-10-CM Diagnosis Coding

A patient with essential hypertension and documented chronic kidney disease stage 3 is seen. Which code correctly captures the combined condition?

  1. I13.0 and N18.3
  2. I12.9 and N18.3 Correct answer.
  3. I10 and N18.3
  4. I12.0 and N18.3

Explanation

Hypertensive chronic kidney disease is coded with a combination category, and I12.9 is used when the CKD stage is stage 1 through 4 or unspecified, with an additional code for the stage. I12.0 is reserved for stage 5 CKD or end-stage renal disease.

Question 41ICD-10-CM Diagnosis Coding

A patient is seen for a routine annual gynecologic examination with no complaints or abnormalities found. Which code is reported?

  1. Z12.4
  2. Z01.419 Correct answer.
  3. Z00.00
  4. Z01.411

Explanation

Z01.419, encounter for gynecological examination with no abnormal findings, is the appropriate code for a routine gynecologic exam without complaints. Z01.411 is for a gynecologic exam with abnormal findings.

Question 42ICD-10-CM Diagnosis Coding

Under ICD-10-CM guidelines, how is a neoplasm documented as "metastatic" from an unknown primary site coded?

  1. Code C80.1, malignant neoplasm of unspecified site Correct answer.
  2. Code only the secondary site with a personal history code
  3. Code the primary site as unknown with a secondary code
  4. Code the metastatic site as primary

Explanation

When a patient presents with metastatic disease and the primary site is not documented, C80.1 is assigned to represent the malignant neoplasm of unspecified site. The metastatic site may also be coded as secondary per documentation.

Question 43ICD-10-CM Diagnosis Coding

Which of the following best describes the purpose of the Tabular List in ICD-10-CM?

  1. To replace the Alphabetic Index
  2. To list only the codes that require seventh characters
  3. To list codes by main term and subterm
  4. To provide the numeric and alphanumeric classification with notes and conventions Correct answer.

Explanation

The Tabular List presents the classification in code order with instructional notes, inclusion and exclusion terms, and conventions such as "code first" or "use additional code." The Alphabetic Index is used to locate candidate codes by main term.

Question 44ICD-10-CM Diagnosis Coding

A patient has documented bilateral osteoarthritis of the knees. Which code is assigned?

  1. M17.9
  2. M17.0 Correct answer.
  3. M17.12
  4. M17.11

Explanation

M17.0 describes bilateral primary osteoarthritis of the knee. Laterality-specific codes M17.11 and M17.12 are used for unilateral involvement of the right or left knee, respectively.

Question 45ICD-10-CM Diagnosis Coding

A patient with a documented pressure ulcer of the sacral region, stage 2, is seen. Which code is assigned?

  1. L89.162
  2. L89.152 Correct answer.
  3. L89.142
  4. L89.150

Explanation

L89.152 describes a pressure ulcer of the sacral region, stage 2. The final character identifies the stage, with stage 2 represented by the digit 2 in the sacral region subcategory.

Question 46ICD-10-CM Diagnosis Coding

When a patient is admitted for a condition and develops a complication during the stay, how is the complication typically reported?

  1. As an external cause code only
  2. As the principal diagnosis
  3. It is not reported
  4. As a secondary diagnosis Correct answer.

Explanation

Complications that arise during an inpatient stay are generally reported as secondary diagnoses, while the condition that prompted admission remains the principal diagnosis. This reflects the reason for admission.

Question 47ICD-10-CM Diagnosis Coding

Which ICD-10-CM code describes a normal first pregnancy at 12 weeks of gestation with no complications?

  1. Z33.1
  2. Z34.90 Correct answer.
  3. O09.90
  4. Z34.00

Explanation

Z34.90 describes supervision of a normal first pregnancy, unspecified trimester. Z34.00 is supervision of a normal first pregnancy, first trimester, which is more specific when the trimester is documented.

Question 48ICD-10-CM Diagnosis Coding

In ICD-10-CM, what is the purpose of an Excludes1 note?

  1. To identify optional additional codes
  2. To identify codes that require a fifth digit
  3. To indicate that the excluded condition cannot be coded with the code in question Correct answer.
  4. To indicate that the excluded condition may be coded with the code in question

Explanation

An Excludes1 note indicates that the excluded condition is not reported with the code under which the note appears because the two conditions cannot occur together. An Excludes2 note indicates that the excluded condition may be reported separately.

Question 49ICD-10-CM Diagnosis Coding

A patient is seen for an initial encounter for a closed fracture of the right distal radius. Which code reflects the encounter?

  1. S52.501A Correct answer.
  2. S52.501G
  3. S52.501D
  4. S52.501S

Explanation

The seventh character A denotes an initial encounter for a closed fracture. Characters D, G, and S denote subsequent encounters with routine healing, subsequent encounter with delayed healing, and sequela, respectively.

Question 50ICD-10-CM Diagnosis Coding

Which of the following is the correct code for an encounter for immunization?

  1. Z76.89
  2. Z29.9
  3. Z28.9
  4. Z23 Correct answer.

Explanation

Z23 is the code for encounter for immunization and is used when a patient is seen solely for a vaccine administration. The vaccine product itself is reported with a separate code from the CPT or vaccine code set.