PCI SSCPCI DSSScoping SegmentationEASYFree question
What documentation supports PCI DSS scoping decisions?
- A.Vendor contracts, insurance certificates, background check records, training attendance sheets, and the corporate organization chart with reporting lines
- B.Penetration test reports, vulnerability scan results, patch records, antivirus logs, and a signed management attestation letter for each assessment year
- C.Firewall configuration backups, switch port maps, DHCP lease tables, DNS zone files, and the change tickets for each firewall rule modification
- D.Network diagrams, data flow diagrams, system inventory, architecture documentation, and justification for out-of-scope classifications
Why D is correct
Scoping requires comprehensive documentation including network and data flow diagrams, system inventories, architecture descriptions, and justified out-of-scope determinations.
Know someone studying for PCI DSS? Send them this one.