PCI SSCPCI DSSSecurity PoliciesEASYFree question
What does PCI DSS require in a remote access policy?
- A.A policy naming the vendors that can access systems remotely, session timeout limits (15 minutes), approved jump hosts, and a log of each connection to the CDE
- B.A policy listing the administrators who hold remote credentials, encryption requirements (TLS 1.2), approved VPN gateways, and a quarterly review of remote sessions to the CDE
- C.A policy defining who can access remotely, authentication requirements (including MFA), approved methods, and restrictions on remote access to the CDE
- D.A policy defining the employees who can work remotely, equipment standards (laptops), approved hours, and travel limits
Why C is correct
Remote access policies must define authorized users, authentication requirements including MFA, approved methods, and specific restrictions for CDE access.
Know someone studying for PCI DSS? Send them this one.