Free Practice Questions for the PCI SSC Certification CPSA Exam (2026 Updated)

The head of the vendor facility

The Security Manager

Both the Security Manager and the Production Manager

The Security Manager, Production Manager, and the head of the vendor facility

The employee must be escorted from the premises immediately

The employee's locker and desk must be searched prior to termination

The Human Resources department must be notified prior to termination

The security manager must be notified in writing prior to termination

In any HSA room approved by the security manager

Either in the HSA printing room or destruction room

Only in the HSA destruction room

Either in the HSA destruction room or a loading bay that meets all requirements of a destruction room

Card personalization

Host Card Emulation (HCE) provisioning

Secure Element (SE) provisioning

Fulfillment

For at least 12 months after termination of the contract of employment

For at least 18 months after termination of the contract of employment

For at least 24 months after termination of the contract of employment

It is not a requirement to store this information beyond termination of the contract

Vendor senior management

Payment brands

Affected issuers

PCI SSC

A clear segregation of duties is maintained between production staff and guards

A clear segregation of duties is maintained between guard and reception related job functions

There is always at least one guard on-site, including outside of working hours, to monitor security systems and premises

There is always at least one guard in the HSA and one guard in the security control room at all times

Have the CPSA Company’s point of contact request the document

Download it from PCI SSC’s Document Library

Email a request for the document to PCI SSC

View it directly via PCI SSC Assessor Portal

PCI SSC

Assessor

Issuing banks

Payment brands

They may be put into remediation or revoked by the applicable payment brands

They may be put into remediation or revoked by PCI SSC

They may be fined by the applicable payment brands

They may be fined by PCI SSC

Payment brands

Issuing banks

Vendor

PCI SSC

Complete annual requalification training or complete 3 assessments for different facilities each year

Earn and document at least 20 hours of Continuing Professional Education (CPE) over 3 years

Earn an additional professional certification from List A or B of the Qualification Requirements (QRs)

Submit evidence of internal training in a relevant area (as per the QRs)