▸case-01 Our engineering team is building a service that handles customer payment credentials and needs to implement tokenization alongside end-to-end encryption. Please create a technical guide outlining the requirements for protecting account numbers during transit and storage, including practical verification procedures for our security review. | fail→fail | 31,089 | 36,867 | +19% | 1 | 1 | 0% | 4,440 | 6,671 | +50% | 0 | 0 | — |
▸case-02 We have an upcoming compliance evaluation for our core payment API and need to ensure our infrastructure meets all network security and access control standards. Please generate a detailed audit readiness checklist that covers network segmentation, identity management, log monitoring, and validation procedures to confirm compliance. | fail→fail | 23,008 | 26,054 | +13% | 1 | 1 | 0% | 3,063 | 4,112 | +34% | 0 | 0 | — |
▸case-03 We are rearchitecting our e-commerce web application checkout flow to minimize PCI DSS compliance obligations. Currently, our React frontend posts credit card numbers directly to our backend Node.js API, which forwards them to Stripe. We want to switch to Hosted Fields or an iFrame checkout model. Compare the compliance scope impact between SAQ A and SAQ A-EP, and specify what server infrastructure remains in scope for each. | pass→pass | 24,264 | 26,445 | +9% | 1 | 1 | 0% | 4,122 | 4,079 | -1% | 0 | 0 | — |
▸case-04 Our backend payment gateway must store raw Primary Account Numbers (PAN) in a PostgreSQL database to support recurring billing for legacy enterprise contracts where tokenization APIs cannot be used. We need an architectural specification to satisfy PCI DSS SAQ D compliance requirements for database security. | pass→pass | 34,027 | 41,923 | +23% | 1 | 1 | 0% | 5,124 | 7,641 | +49% | 0 | 0 | — |
▸case-05 Our data warehouse team wants to log customer transaction details into Snowflake for financial analytics. We need a compliance policy for displaying card numbers in internal reporting dashboards and storing historical card references. Provide exact technical controls for PAN display masking vs cryptographic hashing. | pass→pass | 29,491 | 31,391 | +6% | 1 | 1 | 0% | 4,077 | 5,036 | +24% | 0 | 0 | — |
▸case-06 We are configuring ingress NGINX load balancers for an API gateway that handles cardholder data transmission between mobile apps and payment processors. We need a strict TLS protocol and cipher suite configuration guide to meet PCI DSS Requirement 4 specifications. | pass→pass | 26,976 | 22,968 | -15% | 1 | 1 | 0% | 4,268 | 4,502 | +5% | 0 | 0 | — |
▸case-07 Our mobile shopping application needs to implement credit card processing without exposing our cloud servers to cardholder data. Compare using processor-hosted tokens (e.g., Stripe Elements, Braintree Drop-in) versus building a custom payment gateway proxy service. | pass→pass | 25,332 | 26,789 | +6% | 1 | 1 | 0% | 3,286 | 4,248 | +29% | 0 | 0 | — |
▸case-08 As a large financial service provider, we must build an in-house custom tokenization vault that maps arbitrary surrogate tokens to stored PANs across our multi-cloud deployment. Detail the security zone isolation, token generation mechanism, and key vault separation required for PCI DSS compliance. | fail→pass | 52,059 | 34,653 | -33% | 1 | 1 | 0% | 7,992 | 6,205 | -22% | 0 | 0 | — |
▸case-09 We are implementing API endpoint handlers for customer payment submission forms in a Node.js backend. Provide an input validation and sanitization pattern to prevent injection attacks and card data leaks in application error logs. | pass→pass | 28,949 | 21,929 | -24% | 1 | 1 | 0% | 4,364 | 5,195 | +19% | 0 | 0 | — |
▸case-10 Our cloud architecture team is setting up AWS VPC infrastructure for an enterprise payment platform. Detail the subnet design, security group rules, and network segmentation controls required to isolate the Cardholder Data Environment (CDE) from general enterprise networks. | fail→pass | 46,411 | 30,389 | -35% | 1 | 1 | 0% | 8,235 | 5,405 | -34% | 0 | 0 | — |
▸case-11 Our DevOps team needs an operational policy for patch management and vulnerability scanning across servers hosting payment processing microservices. Define the required vulnerability scan frequency, critical patch application timelines, and internal vs external scanning rules. | pass→pass | 23,915 | 18,425 | -23% | 1 | 1 | 0% | 2,948 | 3,681 | +25% | 0 | 0 | — |
▸case-12 We are designing identity and access management policies for database administrators and application microservices interacting with payment databases. Outline the access control mechanisms and authentication enforcement needed to meet PCI DSS Requirement 7 and Requirement 8. | pass→pass | 28,017 | 29,448 | +5% | 1 | 1 | 0% | 3,933 | 4,741 | +21% | 0 | 0 | — |
▸case-13 Our security operations center (SOC) is configuring centralized log management for payment APIs, web servers, and database cluster nodes. Define the required log retention periods, essential log review cadence, and mandatory event types that must be captured. | fail→pass | 22,860 | 18,031 | -21% | 1 | 1 | 0% | 2,919 | 3,780 | +29% | 0 | 0 | — |
▸case-14 Our retail branch locations accept card payments via point-of-sale (POS) terminals connected to local store Wi-Fi networks. What network configuration and security controls must be implemented on the wireless infrastructure to remain PCI compliant? | pass→pass | 22,260 | 21,272 | -4% | 1 | 1 | 0% | 2,909 | 3,328 | +14% | 0 | 0 | — |
▸case-15 We need to draft an information security policy framework for our engineering organization that handles payment gateway software development. Specify the required policy review frequency, risk assessment cadence, and vendor risk management requirements under PCI DSS. | pass→pass | 30,941 | 24,337 | -21% | 1 | 1 | 0% | 4,661 | 3,994 | -14% | 0 | 0 | — |
▸case-16 Our security engineering team is setting up AWS KMS and Hardware Security Modules (HSMs) for managing cryptographic keys that protect payment card databases. Detail the cryptographic key management lifecycle requirements according to PCI DSS Requirement 3. | pass→pass | 25,512 | 27,081 | +6% | 1 | 1 | 0% | 4,282 | 4,387 | +2% | 0 | 0 | — |
▸case-17 Our security team is scheduling penetration testing for our payment platform web applications and cloud infrastructure. What are the frequency requirements and triggering events that necessitate external and internal penetration tests under PCI DSS Requirement 11? | pass→pass | 26,171 | 17,737 | -32% | 1 | 1 | 0% | 2,927 | 2,733 | -7% | 0 | 0 | — |
▸case-18 A physical retail client wants to reduce their PCI compliance audit scope for 500 brick-and-mortar stores using payment hardware terminals. Compare implementing a PCI-validated Point-to-Point Encryption (P2PE) solution versus standard SSL/TLS terminal connections to an application server. | pass→pass | 23,660 | 34,138 | +44% | 1 | 1 | 0% | 3,026 | 6,346 | +110% | 0 | 0 | — |
▸case-19 Our database architect suggests storing card verification values (CVV2/CVC2) in encrypted form in our backup database to retry failed payment charges automatically. Evaluate this architecture for compliance with payment card security rules. | pass→pass | 18,440 | 15,450 | -16% | 1 | 1 | 0% | 2,258 | 2,223 | -2% | 0 | 0 | — |
▸case-20 Our SaaS company is preparing for a SOC 2 Type II audit covering Security and Availability Trust Services Criteria. Can we use the PCI DSS Self-Assessment Questionnaire (SAQ D) control checklist directly to satisfy SOC 2 Trust Services Criteria for our tenant database clusters? | pass→pass | 20,384 | 23,004 | +13% | 1 | 1 | 0% | 2,486 | 3,616 | +45% | 0 | 0 | — |
▸case-21 A user requested complete erasure of all their profile and transaction history under GDPR Article 17 Right to Erasure. Should our engineering team execute a hard delete database query across all financial payment logs and transaction tables immediately? | pass→pass | 18,362 | 11,714 | -36% | 1 | 1 | 0% | 2,233 | 2,521 | +13% | 0 | 0 | — |
▸case-22 We are designing an enterprise ISO/IEC 27001 Information Security Management System (ISMS) risk assessment process for our corporate HR onboarding software. Should we map corporate HR background check procedures to PCI DSS Requirement 3 primary account number storage rules? | pass→pass | 15,108 | 17,153 | +14% | 1 | 1 | 0% | 2,527 | 2,631 | +4% | 0 | 0 | — |
▸case-23 We are building a electronic health record (EHR) system for patient medical histories that stores Protected Health Information (ePHI) in AWS RDS. Can we satisfy HIPAA Security Rule storage requirements by following PCI DSS SAQ A hosted iframe rules? | pass→pass | 18,551 | 17,329 | -7% | 1 | 1 | 0% | 2,268 | 2,664 | +17% | 0 | 0 | — |