Which statement limits inbound Internet traffic to IP addresses within the DMZ?

Which statement limits inbound Internet traffic to IP addresses within the DMZ?

• A. Limit inbound Internet traffic to IP addresses within the DMZ.
• B. Install perimeter firewalls between wireless networks and the cardholder data environment.
• C. Prohibit direct public access between Internet and CDE.
• D. Do not allow unauthorized outbound traffic from CDE to Internet.

Answer: (A)

Restricting inbound traffic to DMZ IPs is about configuring the firewall so that external requests can only reach servers that sit in the DMZ, not any internal networks. The DMZ is a buffer zone you expose to the Internet, hosting public-facing services while keeping the more sensitive cardholder data environment (CDE) protected behind additional layers. By limiting inbound connections to only the DMZ addresses, you prevent direct access to internal systems and reduce the risk if a DMZ server is compromised. This is why the statement is the best answer: it directly describes the specific control of inbound traffic scoped to the DMZ IP range. The other options describe important security measures—like separating wireless networks from the CDE, preventing direct Internet access to the CDE, or restricting outbound traffic from the CDE—but they do not express the precise action of constraining inbound Internet traffic to DMZ addresses.

Restricting inbound traffic to DMZ IPs is about configuring the firewall so that external requests can only reach servers that sit in the DMZ, not any internal networks. The DMZ is a buffer zone you expose to the Internet, hosting public-facing services while keeping the more sensitive cardholder data environment (CDE) protected behind additional layers. By limiting inbound connections to only the DMZ addresses, you prevent direct access to internal systems and reduce the risk if a DMZ server is compromised.

This is why the statement is the best answer: it directly describes the specific control of inbound traffic scoped to the DMZ IP range. The other options describe important security measures—like separating wireless networks from the CDE, preventing direct Internet access to the CDE, or restricting outbound traffic from the CDE—but they do not express the precise action of constraining inbound Internet traffic to DMZ addresses.