Which statement accurately reflects the restriction on group, shared, and generic IDs?

Which statement accurately reflects the restriction on group, shared, and generic IDs?

• A. Generic user IDs are required for administrator tasks.
• B. Shared user IDs exist for system administration.
• C. Shared and generic IDs are used to administer system components.
• D. Shared and generic IDs are not used to administer any system components.

Answer: (D)

The main idea here is accountability through unique IDs. In PCI DSS, administration of system components must be tied to individual users so that every action can be traced to a specific person. Shared, group, and generic IDs muddy who actually performed what, making it impossible to audit effectively. Therefore, the restriction is that shared and generic IDs are not used to administer any system components, since using them would sacrifice traceability and accountability. The other options imply using these IDs for administration, which would defeat the purpose of unique-user accountability.

The main idea here is accountability through unique IDs. In PCI DSS, administration of system components must be tied to individual users so that every action can be traced to a specific person. Shared, group, and generic IDs muddy who actually performed what, making it impossible to audit effectively. Therefore, the restriction is that shared and generic IDs are not used to administer any system components, since using them would sacrifice traceability and accountability. The other options imply using these IDs for administration, which would defeat the purpose of unique-user accountability.