Free Cisco 400-007 Actual Exam Questions - Question 9 Discussion

E imo, having a solid risk management policy (E) covers ongoing compliance and sets the framework for specific actions like risk analyses. B is kind of a given for any security standard, so that feels like a must-do too.

E imo—establishing risk management policies feels more foundational than just doing one-off risk analyses (A). You need a formal policy in place to guide those analyses and actions. Plus, B makes sense because firewalls are explicitly required to protect cardholder data environments. Antivirus (C) is recommended but not always mandatory, and monitoring policies (D) could overlap with risk management, but policies need a solid framework first. So, E and B for me.

A/E? Conducting risk analyses and establishing risk management policies seem like foundational steps for PCI compliance, beyond just technical controls like firewalls.

It’s A and B because you need to identify risks regularly and have firewalls in place to protect cardholder data. Monitoring policies are important but come later; risk management policies are too broad here.

A and B, since risk analysis and firewalls are foundational PCI steps.

B/D? Firewalls block unauthorized access, and monitoring policies help detect suspicious activity, both key PCI DSS steps. Risk analyses and antivirus are important but maybe less directly mandated.

Maybe A and B. Firewalls are a baseline technical control, so B makes sense, and risk analyses help identify threats, which is crucial for compliance. Antivirus software is good but might not be explicitly required for all merchants. Monitoring policies (D) and risk management (E) sound important but feel more like ongoing governance rather than core PCI steps. So A and B seem like the essentials you can’t skip.

Guessing A and C since antivirus is a basic security must along with risk analysis.

Maybe B and D. Firewalls are definitely a must, and monitoring policies sound important to catch any security issues early. Risk management policies seem broader, not sure if they’re explicitly required here.

Probably A and B, risk analyses and firewalls seem key.