Which term describes the mechanism to control device access to the network and cardholder data?

Which term describes the mechanism to control device access to the network and cardholder data?

• A. Access Control List
• B. Network Access Control (NAC)
• C. Firewall
• D. Intrusion Detection System (IDS)

Answer: (B)

The mechanism being tested is Network Access Control, which governs how devices gain access to the network and to the cardholder data environment. NAC authenticates devices and checks their security posture (like patch levels, antivirus status, and configuration compliance) before granting network access, or places noncompliant devices into restricted remediation networks. This ensures that only trusted, compliant devices can reach systems that handle cardholder data, aligning with PCI DSS goals for secure network access and segmentation. Why this fits best: it directly controls whether a device can connect to the network and to sensitive data, and it enforces policy at the point of admission. It goes beyond static ACLs, which simply specify allowed or denied addresses without evaluating device health, and beyond firewalls, which manage traffic flow but don’t verify device compliance before access. It also differs from IDS, which monitors for threats and reports them rather than actively controlling access.

The mechanism being tested is Network Access Control, which governs how devices gain access to the network and to the cardholder data environment. NAC authenticates devices and checks their security posture (like patch levels, antivirus status, and configuration compliance) before granting network access, or places noncompliant devices into restricted remediation networks. This ensures that only trusted, compliant devices can reach systems that handle cardholder data, aligning with PCI DSS goals for secure network access and segmentation.

Why this fits best: it directly controls whether a device can connect to the network and to sensitive data, and it enforces policy at the point of admission. It goes beyond static ACLs, which simply specify allowed or denied addresses without evaluating device health, and beyond firewalls, which manage traffic flow but don’t verify device compliance before access. It also differs from IDS, which monitors for threats and reports them rather than actively controlling access.