Which statement describes firewall requirements for restricting connections between untrusted networks and the cardholder data environment?

Which statement describes firewall requirements for restricting connections between untrusted networks and the cardholder data environment?

• A. Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.
• B. Documentation and business justification and approval for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure.
• C. Limit inbound and outbound traffic to that which is necessary for the cardholder data environment.
• D. Prohibit direct public access between Internet and CDE.

Answer: (A)

Firewalls sit at the boundary between untrusted networks (like the Internet) and the cardholder data environment, and the essential aim is to stop anything that isn’t explicitly allowed from reaching every component inside the CDE. The best statement captures this by directing you to build firewall and router configurations that restrict connections between those untrusted networks and any system components within the CDE. That means creating precise rules for what traffic, by which protocols and ports, can pass in or out, and applying those rules across all CDE components. This approach directly enforces the gateway that protects cardholder data by preventing unauthorized access and ensuring only necessary, approved communications occur, which aligns with PCI DSS requirements to install and maintain a firewall configuration to protect cardholder data. Other options touch important aspects of security but don’t describe the full boundary-control practice. Documentation and approvals (without the actual gateway rules) support governance but don’t implement the protective boundary. Limiting inbound and outbound traffic is a core firewall principle, but it’s broader and not specifically framed around the untrusted-to-CDE boundary across all components. Prohibiting direct public access is a valid objective, yet it’s narrower and doesn’t by itself describe how to configure firewall and router rules to enforce the boundary for every CDE component.

Firewalls sit at the boundary between untrusted networks (like the Internet) and the cardholder data environment, and the essential aim is to stop anything that isn’t explicitly allowed from reaching every component inside the CDE. The best statement captures this by directing you to build firewall and router configurations that restrict connections between those untrusted networks and any system components within the CDE. That means creating precise rules for what traffic, by which protocols and ports, can pass in or out, and applying those rules across all CDE components. This approach directly enforces the gateway that protects cardholder data by preventing unauthorized access and ensuring only necessary, approved communications occur, which aligns with PCI DSS requirements to install and maintain a firewall configuration to protect cardholder data.

Other options touch important aspects of security but don’t describe the full boundary-control practice. Documentation and approvals (without the actual gateway rules) support governance but don’t implement the protective boundary. Limiting inbound and outbound traffic is a core firewall principle, but it’s broader and not specifically framed around the untrusted-to-CDE boundary across all components. Prohibiting direct public access is a valid objective, yet it’s narrower and doesn’t by itself describe how to configure firewall and router rules to enforce the boundary for every CDE component.