What policy describes outbound CHD traffic to the Internet?

What policy describes outbound CHD traffic to the Internet?

• A. Allow all outbound traffic from the CHD environment to the Internet.
• B. Do not allow unauthorized outbound traffic from the CHD environment to the Internet.
• C. Allow outbound traffic only to the DMZ.
• D. Block all inbound traffic to the CHD environment.

Answer: (B)

The key idea is controlling how data leaves the Cardholder Data Environment (CDE). Outbound traffic from the CDE to the Internet must be restricted so that only connections that are explicitly approved are allowed. This prevents unauthorized data from being exfiltrated and reduces the risk from malware that might try to reach external sites. In practice, you implement outbound filtering and an allow-list approach: define which destinations, ports, and protocols are permitted, and block everything else. The policy that states you do not allow unauthorized outbound traffic captures this protective posture. Why this fits best: it directly enforces the responsible, restricted egress path for the CDE, aligning with the need to minimize outbound exposure. The other ideas describe looser or different focuses—allowing all outbound traffic is insecure, allowing outbound only to a DMZ is a narrower rule that may not cover all legitimate Internet needs, and blocking inbound traffic alone addresses a different direction of risk.

The key idea is controlling how data leaves the Cardholder Data Environment (CDE). Outbound traffic from the CDE to the Internet must be restricted so that only connections that are explicitly approved are allowed. This prevents unauthorized data from being exfiltrated and reduces the risk from malware that might try to reach external sites. In practice, you implement outbound filtering and an allow-list approach: define which destinations, ports, and protocols are permitted, and block everything else. The policy that states you do not allow unauthorized outbound traffic captures this protective posture.

Why this fits best: it directly enforces the responsible, restricted egress path for the CDE, aligning with the need to minimize outbound exposure. The other ideas describe looser or different focuses—allowing all outbound traffic is insecure, allowing outbound only to a DMZ is a narrower rule that may not cover all legitimate Internet needs, and blocking inbound traffic alone addresses a different direction of risk.