Where must a firewall be located according to PCI requirements?

Where must a firewall be located according to PCI requirements?

• A. A single firewall at the perimeter of the data center.
• B. Firewall placement is optional for the DMZ.
• C. A firewall at each Internet connection and between the DMZ and the internal network.
• D. No firewall required.

Answer: (C)

PCI requirements protect the cardholder data environment by enforcing strong boundary defenses. You must have a firewall at every Internet connection and a firewall between the DMZ and the internal network to create and enforce separate security zones. Placing a firewall only at one outer perimeter leaves gaps in segmentation, and the DMZ must be isolated from the internal network with its own controlled boundary so that any compromise in the DMZ can’t directly reach cardholder data. That’s why configuring firewalls at each Internet connection and between the DMZ and internal network is the correct approach.

PCI requirements protect the cardholder data environment by enforcing strong boundary defenses. You must have a firewall at every Internet connection and a firewall between the DMZ and the internal network to create and enforce separate security zones. Placing a firewall only at one outer perimeter leaves gaps in segmentation, and the DMZ must be isolated from the internal network with its own controlled boundary so that any compromise in the DMZ can’t directly reach cardholder data. That’s why configuring firewalls at each Internet connection and between the DMZ and internal network is the correct approach.