Inbound Internet traffic should be limited to IP addresses within which zone?

Inbound Internet traffic should be limited to IP addresses within which zone?

• A. Internal corporate network
• B. The DMZ
• C. The cardholder data environment (CDE)
• D. Any Internet-facing IP

Answer: (B)

The main idea is using a buffer zone between the untrusted Internet and the trusted internal network. Inbound traffic from the Internet should be directed to systems in the DMZ, which are designed to be publicly accessible yet tightly controlled with firewall rules and minimal services. This setup protects the cardholder data environment and the internal network by preventing direct Internet access to sensitive systems. Allowing inbound traffic straight to internal networks or the CDE would bypass these protections, and treating every Internet-facing IP as a gateway would bypass the deliberate segmentation that limits exposure.

The main idea is using a buffer zone between the untrusted Internet and the trusted internal network. Inbound traffic from the Internet should be directed to systems in the DMZ, which are designed to be publicly accessible yet tightly controlled with firewall rules and minimal services. This setup protects the cardholder data environment and the internal network by preventing direct Internet access to sensitive systems. Allowing inbound traffic straight to internal networks or the CDE would bypass these protections, and treating every Internet-facing IP as a gateway would bypass the deliberate segmentation that limits exposure.