PCI Card Production Security Assessor (CPSA) Qualification

QUESTION NO: 1
Who is required to approve visitor entry to the HSA or cloud-based provisioning environment?

A. The head of the vendor facility B. The Security Manager C. The Security Manager, Production Manager, and the head of the vendor facility D. Both the Security Manager and the Production Manager

Correct Answer: C

QUESTION NO: 2
A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

A. When the third party s liability insurance covers the risk B. None, only people on the pre-approved list may enter C. When no card production activities are taking place D. When they are approved by the physical security manager or senior management

Correct Answer: D

QUESTION NO: 3
Where can misprinted, partially finished cards be shredded?

A. In any HSA room approved by the security manager B. Only in the HSA destruction room C. Either in the HSA printing room or destruction room D. Either in the HSA destruction room or a loading bay that meets all requirements of a destruction room

Correct Answer: D

QUESTION NO: 4
After reviewing their completed ROC and AOC, which state that they are compliant, the vendor wishes to be listed on PCI SSC's list of Compliant Card Vendors. How should you assist them with the listing process?

A. Inform the vendor that PCI SSC does not list compliant vendors B. Submit only the AOC to PCI SSC C. Submit the full ROC to PCI SSC D. Inform the vendor that they must request a listing via the payment brand(s) that received their ROC

Correct Answer: D

QUESTION NO: 5
Before you go on-site, the vendor's primary contact communicates a legitimate reason for delaying the assessment for several months. Who can approve the change in the report delivery schedule?

A. Affected issuers B. Vendor senior management C. PCI SSC D. Payment brands

Correct Answer: C

QUESTION NO: 6
You wish to check that you are using the most current version of the Card Production requirements. What should you do?

A. Have the CPSA Company's point of contact request the document B. Download it from PCI SSC's Document Library C. Email a request for the document to PCI SSC D. View it directly via PCI SSC Assessor Portal

Correct Answer: B

PCI Card Production Security Assessor (CPSA) Qualification - CPSA Exam Questions