CPSA Exam Questions and Answers | Exam-Dumps (Page: 2)

QUESTION: 6

An assessor is unsure if log review and interview is sufficient testing for a requirement.
Who can best answer this question?

Payment brands
Issuing banks
Vendor
PCI SSC

Answer(s): D

Reference:

https://www.pcisecuritystandards.org/about_us/#:~:text=The%20PCI%20SSC%20mission%20is,and %20effective%20implementation%20by%20stakeholders

Reveal Solution Next Question

QUESTION: 7

When must HSA motion detectors generate an alarm event?

Each time movement is detected
Each time movement is detected outside of regular business hours
Each time movement is detected and the access-control system indicates the room is occupied
Each time movement is detected and the access-control system indicates the room is not occupied

Answer(s): D

Reveal Solution Next Question

QUESTION: 8

Which of these is a requirement of the security control room?

Access must be controlled by a physical key (in case of power-failure)
Access must be monitored in real-time
At least one guard must be present at all times
Dual-control must be used to grant entry

Answer(s): D

Reveal Solution Next Question

QUESTION: 9

During an assessment you ask to see employee records for employees with access to the HS

The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non- compliant, why?
Employee information, including background checks, must be stored for at least seven years
Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)
The vendor must retain the background information for at least 18 months after termination of contract
The vendor must only retain background information for all current employees, not for those that have been terminated

Answer(s): A

Reveal Solution Next Question

The vendor's technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened.
Why might this cause a problem for their assessment?

If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it
During working hours, the alarm should be managed in the security control room, or by a central monitoring service
If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm
During busy times, the local police may not be able to respond

Answer(s): C

Reveal Solution Next Question

PCI CPSA Exam (page: 2)
PCI Card Production Security Assessor (CPSA) Qualification Exam
Updated on: 12-Feb-2026

QUESTION: 6

Reference:

QUESTION: 7

QUESTION: 8

QUESTION: 9

QUESTION: 10

PCI CPSA Exam (page: 2) PCI Card Production Security Assessor (CPSA) Qualification Exam Updated on: 12-Feb-2026

QUESTION: 6

Reference:

QUESTION: 7

QUESTION: 8

QUESTION: 9

QUESTION: 10

PCI CPSA Exam (page: 2)
PCI Card Production Security Assessor (CPSA) Qualification Exam
Updated on: 12-Feb-2026