What is the requirement for firewall and router configurations in relation to untrusted networks?

What is the requirement for firewall and router configurations in relation to untrusted networks?

• A. Build configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.
• B. Allow all traffic from untrusted networks for testing.
• C. Isolate untrusted networks from the cardholder data environment without restrictions.
• D. Only monitor untrusted network traffic.

Answer: (A)

The key idea being tested is that firewall and router configurations must enforce a strict boundary between untrusted networks (like the public Internet) and the cardholder data environment. This means implementing rules that restrict connections from any untrusted network to any system component within the CDE, unless a specific, justified exception is explicitly allowed. This is the best choice because PCI DSS requires a firewall configuration that blocks all unnecessary access from untrusted networks to the cardholder data environment and only permits traffic that is essential for business needs. By building configurations that restrict these connections, you minimize the attack surface and prevent direct or unintended access to systems handling cardholder data. Other options fail to provide proper protection. Allowing all traffic from untrusted networks would expose the CDE to external threats. Isolating untrusted networks from the CDE without restrictions contradicts the purpose of a firewall, since it implies no enforceable controls. Merely monitoring untrusted traffic does not prevent unauthorized access and leaves the CDE vulnerable.

The key idea being tested is that firewall and router configurations must enforce a strict boundary between untrusted networks (like the public Internet) and the cardholder data environment. This means implementing rules that restrict connections from any untrusted network to any system component within the CDE, unless a specific, justified exception is explicitly allowed.

This is the best choice because PCI DSS requires a firewall configuration that blocks all unnecessary access from untrusted networks to the cardholder data environment and only permits traffic that is essential for business needs. By building configurations that restrict these connections, you minimize the attack surface and prevent direct or unintended access to systems handling cardholder data.

Other options fail to provide proper protection. Allowing all traffic from untrusted networks would expose the CDE to external threats. Isolating untrusted networks from the CDE without restrictions contradicts the purpose of a firewall, since it implies no enforceable controls. Merely monitoring untrusted traffic does not prevent unauthorized access and leaves the CDE vulnerable.