Free Card Production Security Assessor (CPSA) Qualification Exam CPSA Exam Practice Test

You are driving to a vendor for their first assessment. The facility is in a rural area, twenty miles away from the nearest large town. What most concerns you about the location?

• The local fire service may not be able to reach the facility within 15 minutes
• Law enforcement services may not be able to reach the facility in a timely manner
• Power blackouts may affect security systems
• There may not be adequate retail outlets, which may cause problems when sourcing lunch items for onsite personnel

You wish to check that you are using the most current version of the Card Production requirements. What should you do?

• Have the CPSA Company’s point of contact request the document
• Download it from PCI SSC’s Document Library
• Email a request for the document to PCI SSC
• View it directly via PCI SSC Assessor Portal

Which of the following statements is true in relation to visitor access badges?

• Each visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee
• Each visitor entering the facility must wear their issued access badge above waist height
• Badges with access-controls must not be issued to visitors
• Unissued visitor access badges must be securely stored

A vendor receives cardholder information and keys from a bank. The vendor then performs the following:Uses its HSM to create keysCreates cardholder information specific to each cardholder, including name and PANFormats the data for the hardware that will put it on a cardWrites it to an encrypted fileWhich of the following best describes this process?

• Data creation
• Data preparation
• Manufacture
• Pre-personalization

For how long must a vendor retain all applicant and employee background information on file?

• For at least 12 months after termination of the contract of employment
• For at least 18 months after termination of the contract of employment
• For at least 24 months after termination of the contract of employment
• It is not a requirement to store this information beyond termination of the contract

Which of these are guards allowed access to?

• HSAs
• Audit logs
• Loading bays
• Physical master keys that provide access to card production or provisioning areas

A vendor puts cardholder information into a chip by sliding a payment card through a machine that programs it and verifies the data. The chip can make contactless transactions. Which of the following best describes the vendor’s activity?

• Card personalization
• Host Card Emulation (HCE) provisioning
• Secure Element (SE) provisioning
• Fulfillment

Which of the following statements is true about the facility’s non-emergency exits?

• They must be contact-alarm monitored only when card production activities are taking place
• They must be configured to prevent staff tailgating
• They may be left unlocked when a guard is present
• They must be fitted with biometric access-control devices

Which of the following must every assessor do to maintain their CPSA certification?

• Complete annual requalification training or complete 3 assessments for different facilities each year
• Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years
• Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)
• Submit evidence of internal training in a relevant area (as per the QRs)

A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is functioning correctly. When must the status of the access change?

• Only when an unauthorised badge is presented
• Only when the person has successfully completed the access cycle
• Upon initial entry of the person into the device, prior to completion of the access cycle
• Upon initial presentation of an authorised badge, prior to completion of the access cycle