Free Card Production Security Assessor (CPSA) Qualification Exam CPSA Exam Practice Test

Which of the following statements about unsolicited visitors is true?

• They must be turned away
• They must complete an NDA before entry is granted
• They must be able to prove a legitimate reason for their visit prior to entry
• They must be registered, their identities confirmed, and must be allocated an escort before entry

A vendor puts cardholder information into a chip by sliding a payment card through a machine that programs it and verifies the data. The chip can make contactless transactions. Which of the following best describes the vendor’s activity?

• Card personalization
• Host Card Emulation (HCE) provisioning
• Secure Element (SE) provisioning
• Fulfillment

A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

• PCI SSC
• Assessor
• Issuing banks
• Payment brands

A card production vendor employs a contracted guard service from an outside source. What is one of the responsibilities of the contracted service?

• Provide only certified guards
• Register their service with the VPA
• Maintain their own liability insurance in case of losses to card material
• Undergo their own Card Production assessment and provide evidence of a passing result

A CPSA Company has submitted multiple reports that are incomplete and do not contain the information described in the reporting instructions. Which of the following are possible outcomes?

• They may be put into remediation or revoked by the applicable payment brands
• They may be put into remediation or revoked by PCI SSC
• They may be fined by the applicable payment brands
• They may be fined by PCI SSC

Which of the following statements is true about the facility’s non-emergency exits?

• They must be contact-alarm monitored only when card production activities are taking place
• They must be configured to prevent staff tailgating
• They may be left unlocked when a guard is present
• They must be fitted with biometric access-control devices

Which of the following must be used by the vendor to protect doors that provide access to buildings containing air conditioning equipment?

• Security tape that will leave an observable trace each time a door is opened
• Electrical contacts that log each open and close event to a secure system memory
• Magnetic contacts that are permanently alarmed and that are connected to the security control- room panels
• Physical locks with a limited set of keys under constant supervision by a guard in the security control-room

If a vendor plans to terminate an employee, which of these must be done?

• The employee must be escorted from the premises immediately
• The employee's locker and desk must be searched prior to termination
• The Human Resources department must be notified prior to termination
• The security manager must be notified in writing prior to termination

Which of the following must every assessor do to maintain their CPSA certification?

• Complete annual requalification training or complete 3 assessments for different facilities each year
• Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years
• Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)
• Submit evidence of internal training in a relevant area (as per the QRs)

A vendor uses codes from a chip manufacturer to ‘unlock’ chips and prepare them for use by adding applications and keys. Which of the following best describes this process?

• Data creation
• Data preparation
• Manufacture
• Pre-personalization