Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?

Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?

• A. Prohibit direct public access between the Internet and any system component in the cardholder data environment.
• B. Limit inbound Internet traffic to IP addresses within the DMZ.
• C. Implement anti-spoofing measures to detect forged IP addresses.
• D. Documentation for insecure protocols.

Answer: (A)

The key idea is to enforce a strong boundary between the Internet and the cardholder data environment by blocking any direct path from the public Internet to any system inside the CDE. This is a fundamental firewall control: the CDE must be isolated so that external users cannot reach its components directly, forcing all access to go through approved, secured interfaces and paths. That direct prohibition protects sensitive data by ensuring attackers can’t directly hit databases, application servers, or other cardholder data components from the Internet. Other options describe useful security measures but don’t achieve that explicit boundary. Limiting inbound traffic to DMZ addresses still allows, in some configurations, direct access to the CDE if rules aren’t layered properly. Anti-spoofing helps verify traffic origins but doesn’t by itself prevent direct Internet access to CDE components. Documentation of insecure protocols identifies weaknesses, but it doesn’t enforce the network separation required to block direct Internet access to the CDE.

The key idea is to enforce a strong boundary between the Internet and the cardholder data environment by blocking any direct path from the public Internet to any system inside the CDE. This is a fundamental firewall control: the CDE must be isolated so that external users cannot reach its components directly, forcing all access to go through approved, secured interfaces and paths. That direct prohibition protects sensitive data by ensuring attackers can’t directly hit databases, application servers, or other cardholder data components from the Internet.

Other options describe useful security measures but don’t achieve that explicit boundary. Limiting inbound traffic to DMZ addresses still allows, in some configurations, direct access to the CDE if rules aren’t layered properly. Anti-spoofing helps verify traffic origins but doesn’t by itself prevent direct Internet access to CDE components. Documentation of insecure protocols identifies weaknesses, but it doesn’t enforce the network separation required to block direct Internet access to the CDE.