Which statement describes restricting physical access to network devices?

Which statement describes restricting physical access to network devices?

• A. Restrict physical access to wireless access points, gateways, handheld devices, networking hardware, and telecommunication lines.
• B. Restrict physical access only to data center servers.
• C. Physical access restrictions are not required for handheld devices.
• D. Access controls should be purely logical.

Answer: (A)

Protecting hardware from tampering and theft is essential for PCI DSS physical security. The best statement emphasizes restricting physical access to a broad set of network-related equipment—wireless access points, gateways, handheld devices, networking hardware, and telecommunication lines. If access to these devices is physically controlled, it reduces the risk of tampering, device theft, or covert modifications that could expose data or disrupt the network. Limiting restrictions only to data center servers leaves other critical components unprotected, which could still be tampered with or stolen. Claiming that handheld devices don’t need physical access restrictions ignores the risk of loss or theft and potential data exposure. Saying access controls should be purely logical dismisses the layered defense approach that combines both physical and logical controls to protect the cardholder data environment. So, restricting physical access across all these device types best aligns with comprehensive PCI DSS physical security practices.

Protecting hardware from tampering and theft is essential for PCI DSS physical security. The best statement emphasizes restricting physical access to a broad set of network-related equipment—wireless access points, gateways, handheld devices, networking hardware, and telecommunication lines. If access to these devices is physically controlled, it reduces the risk of tampering, device theft, or covert modifications that could expose data or disrupt the network.

Limiting restrictions only to data center servers leaves other critical components unprotected, which could still be tampered with or stolen. Claiming that handheld devices don’t need physical access restrictions ignores the risk of loss or theft and potential data exposure. Saying access controls should be purely logical dismisses the layered defense approach that combines both physical and logical controls to protect the cardholder data environment.

So, restricting physical access across all these device types best aligns with comprehensive PCI DSS physical security practices.