PCI SSCPCI DSSMonitoring TestingEASYFree question
What does PCI DSS Requirement 11 require organizations to do?
- A.Retain audit logs for at least twelve months and keep three months immediately available for analysis
- B.Restrict access to cardholder data by business need to know and assign a unique ID to each person with computer access
- C.Regularly test security systems and processes through vulnerability scanning and penetration testing
- D.Protect stored account data with strong cryptography and manage the keys used to protect it
Why C is correct
Requirement 11 mandates regular testing of security systems and processes, including vulnerability scans, penetration tests, intrusion detection, file integrity monitoring, and wireless analyzer scans.
Know someone studying for PCI DSS? Send them this one.