Score Higher on Verified Assessor_New_V4 | Assessor_New_V4 Exam Questions with Answers

Segmentation is a method of isolating system components that store, process, or transmit cardholder data from systems that do not, by using security controls such as firewalls, routers, switches, or other devices1. Segmentation can reduce the scope of the cardholder data environment (CDE) and thus reduce the scope of the PCI DSS assessment, as only the systems and networks within the CDE or connected to the CDE are subject to PCI DSS requirements2. However, segmentation is not mandatory for PCI DSS compliance, and it is the responsibility of the entity to define and document the scope of their CDE and the segmentation controls they use2.

The assessor’s role is to verify the scope of the CDE and the effectiveness of the segmentation controls, as specified in PCI DSS Requirement 11.3.43. The assessor must verify that the segmentation controls are configured properly and functioning as intended, and that they allow only necessary traffic into the CDE. The assessor must also perform penetration testing on the segmentation controls at least annually and after anychanges to the segmentation methods, to confirm that there are no exploitable vulnerabilities that could allow an attacker to access the CDE from out-of-scope systems3. Therefore, the correct answer is option D.

The other options are not true regarding the role of the assessor in verifying segmentation for PCI DSS. Option A is not true because the assessor must verify not only that the segmentation controls allow only necessary traffic into the CDE, but also that they are configured properly and functioning as intended, as stated in option D. Option B is not true because the assessor does not need to verify that the payment card brands have approved the segmentation, as PCI DSS does not require such approval, although the payment card brands may have their own policies and procedures for segmentation that the entity must follow2. Option C is not true because the assessor does not need to verify that approved devices and applications are used for the segmentation controls, as PCI DSS does not mandate the use of specific devices or applications for segmentation, although it requires the entity to use industry-accepted and strong methods for segmentation2. References:

• Network Segmentation - PCI Security Standards Council
• Guidance for PCI DSS Scoping and Network Segmentation
• PCI DSS v3.2.1

Hashing is a form of one-way encryption that transforms a data element into a unique fixed-size data element (hash value) without a way to get the original data element from the hash value1. Truncation is a method of rendering the full PAN unreadable by permanently removing a segment of the PAN data2. PCI DSS Requirement 3.4 states that entities must render the PAN unreadable wherever it is stored, using any of the following methods: one-way hashes based on strong cryptography, truncation, index tokens and pads, or strong cryptography with associated key-management processes and procedures3. However, PCI DSS Requirement 3.4e also states that if hashed and truncated versions of the same PAN are present in the environment, additional controls must be in place to ensure that the hashed and truncated versions cannot be correlated to reconstruct the original PAN3. This is because if an attacker obtains both the hashed and truncated versions of the same PAN, they may be able to use a brute-force or dictionary attack to guess the original PAN by hashing and truncating different PAN values until they find a match4. Therefore, the correct answer is option A.

The other options are not true regarding the presence of both hashed and truncated versions of the same PAN in an environment. Option B is not true because PCI DSS does not require the hashed version of the PAN to be also truncated, although it is a recommended best practice to further reduce the risk of exposing the original PAN5. Option C is not true because PCI DSS does not require the hashed and truncated versions to be correlated, as this would defeat the purpose of rendering the PAN unreadable and increase the risk of exposing the original PAN. Option D is not true because PCI DSS does not prohibit the presence of both hashed and truncated versions of the same PAN in the same environment, as long as additional controls are in place to prevent the reconstruction of the original PAN. References:

• Protect hashed CardHolder Data according to PCI DSS 3.4 - Advantio
• PCI DSS Truncation Rules and Guidelines - Truvantis
• PCI DSS v3.2.1
• Storing Card Numbers using hashed and truncated version of PAN
• pci dss - Credit card data security - hashing, truncation and encryption - Information Security Stack Exchange

According to the PCI DSS v3.2.1 Quick Reference Guide1, the assessor must derive testing procedures and document them in Appendix E of the ROC. This is one of the requirements for ensuring that testing procedures are defined and documented.