Card payment terminals at the municipal recreation center must meet PCI-aligned hardening rules. What assessment activity confirms systems still match required baselines?
Select an answer to reveal the explanation.
Short Explanation
Baselines are the recipe; compliance checks taste the soup. Compare live configs to the PCI-class rules. Feelings polls, wild exploit free-for-alls, or shredding the recipe do not verify hardening.
Full Explanation
Compliance checks are a control-testing method that verifies live configurations against policy and applicable standards such as PCI-oriented baselines. For card payment terminals at a municipal recreation center, comparing actual hardening state—patch levels, default credentials, encryption settings, network segmentation expectations—to the required baseline confirms systems still match mandated controls after drift, repairs, or vendor changes. That comparison produces objective evidence for assessment and audit readiness.
Informal staff polls about how secure people ‘feel’ are subjective sentiment, not configuration verification. Unlimited production exploit attempts without rules of engagement are unscoping penetration activity and risk payment outages or cardholder-data incidents; they are not the compliance-check activity the stem asks for. Deleting baseline documents after the first audit year removes the reference standard needed for ongoing comparison and weakens continuous compliance.
Exam caveat: Domain 6 lists compliance checks among assessment methods alongside vulnerability assessments, audits, and log reviews. When the question focuses on matching baselines/standards, choose compliance checking—not feelings, unrestricted exploits, or discarding baselines.
Operational check: Maintain versioned PCI-class baselines for recreation-center terminals, run scheduled configuration compliance scans or manual checklists, ticket deviations with owners and due dates, and retain pass/fail evidence for QSA or internal audit review.