1 / 3
PCI ISA Study Guide 2024/25 Questions and Answers
1. SAQ-A: e-commerce or telephone order merchants; processing fully outsourced
to validated 3rd party. No processing, transmitting, storing done by merchant
2. SAQ-B: merchants with imprint machines and/or merchant with only standalone
dial-out terminals
3. SAQ-B-IP: Same as SAQ-B but the terminals not dial-out, the terminals have an
IP connection
4. SAQ-C: Merchants with payment apps connected to the Internet but have no
CHD storage. Not available if doing ecommerce
5. SAQ-C-VT: Merchants who only use virtual terminals from a validated 3rd party.
Do transactions one at a time. Not available if doing ecommerce
6. SAQ-A-EP: Same as SAQ-A but web site could affect the security of outsourced
3rd party solution.
7. SAQ-D: Used by merchants not eligible for any other SAQ. Service providers
must always use SAQ-D
8. Where are firewalls required: Between Internet and CHD, between DMZ and
internal network, between wireless networks and CHD
9. How often must firewall rules be reviewed: 6 months and after significant
environment change
