The PCIP exam consists of 75 multiple choice questions,
which you have to complete in 90 minutes.
The pass mark is 75%, so that's 57 questions you have to get right.
The exam covers four broad areas. Firstly, how payments work and the
entities involved in payment processing, such as merchants,
acquirers,
card schemes or brands, and issuers, basically the subjects we
explored in the first module of this course.
Secondly,
a general overview of all the different PCI standards and how they fit together,
which we looked at in the second and third modules of the course.
Next, specific knowledge about PCI DSS, the Payment Card
Industry Data Security Standard. And then finally,
knowledge about the PCIP Professional qualification and
the Code of Professional Responsibility.
About half the exam will be about PCI DSS with the remaining half
split evenly between the three other subject areas.
The questions are all multiple choice, and they're designed to
test knowledge and not to catch people out.
Let's have a look at a couple of sample questions so you can get a feel
of how they're worded and what the answers look like. Which PCI
standard helps secure physical devices that accept customer PINs? Is it
P2PE, PTS POI, PCI PIN, or PCI TSP?
You might want to pause here to work out the answer before continuing.
The answer is PTS POI. P2PE is concerned with the encryption of
track data from a terminal to a point of decryption within a
service provider or an acquirer.
PCI PIN looks the obvious answer, but remember that this standard is
responsible for how entities in the payment system, such as acquirers, manage
PINs and the PIN encryption keys and decryption keys,
not the devices at merchants the customers used to enter their PINs. And PCI
TSP is the security standard for token service providers,
which has nothing to do with PINs.
So PTS POI is the correct answer.
That's the one that's concerned with the security devices where you
enter to your PINs and where you insert your card.
Let's try another one.
What sanction does the PCI SSC not have against a PCI
professional who was in contravention of the PCI SSC Code
of Professional Responsibility?
And again, let's pause before moving on to see if you can work out the answer.
That's right, the answer is C, issue a warning to the
PCIP's employer because the PCI Professional qualification
is attached to the individual,
not to the organization. The real available sanctions are the
other three answers: Issue a warning to the PCIP, suspend the
PCIP from all PCI programs, and in the worst case, revoke the
PCIP from all PCI qualifications.
I should just also add there's a really good skills assessment in Pluralsight
for PCI knowledge, and if you take that skills assessment,
that'll be a really good indication of whether
you're ready to take the PCIP exam.
Okay, now assuming you passed the exam,
you'll be qualified as a PCIP. The qualification is valid for three years, and
you'll receive a really good‑looking PDF certificate by mail.
Here's what mine looks like.