Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?

Which statement prohibits direct public access between the Internet and any system component in the cardholder data environment?

• A. Prohibit direct public access between the Internet and any system component in the cardholder data environment.
• B. Limit inbound Internet traffic to IP addresses within the DMZ.
• C. Implement anti-spoofing measures to detect and block forged source IP addresses.
• D. Documentation and business justification and approval for use of all services, protocols, and ports allowed.

Answer: (A)

The main idea is to keep the cardholder data environment from being directly reachable from the Internet. This ensures something inside the CDE cannot be accessed with a single, direct Internet connection, reducing exposure to external threats. The statement that directly prohibits Internet access to any system component in the CDE aligns with the goal of network segmentation and layered defenses: public-facing services can sit in a DMZ or similar boundary, but the internal systems containing cardholder data must not be exposed to the Internet without passing through controlled security controls. Why this is the best fit: it states an explicit prohibition of direct public access from the Internet to any CDE component, which is exactly what you need to minimize risk and comply with PCI DSS guidance on isolating the CDE from direct Internet exposure. Why the other options don’t fit: limiting inbound traffic to DMZ addresses improves security but does not inherently prohibit direct access to systems inside the CDE; you could still have a direct path from Internet to internal components if rules aren’t configured perfectly. Anti-spoofing helps verify legitimate sources, not the presence of direct Internet paths to the CDE. Documentation and approvals govern what services are allowed, not the fundamental rule about direct Internet access to CDE components.

The main idea is to keep the cardholder data environment from being directly reachable from the Internet. This ensures something inside the CDE cannot be accessed with a single, direct Internet connection, reducing exposure to external threats. The statement that directly prohibits Internet access to any system component in the CDE aligns with the goal of network segmentation and layered defenses: public-facing services can sit in a DMZ or similar boundary, but the internal systems containing cardholder data must not be exposed to the Internet without passing through controlled security controls.

Why this is the best fit: it states an explicit prohibition of direct public access from the Internet to any CDE component, which is exactly what you need to minimize risk and comply with PCI DSS guidance on isolating the CDE from direct Internet exposure.

Why the other options don’t fit: limiting inbound traffic to DMZ addresses improves security but does not inherently prohibit direct access to systems inside the CDE; you could still have a direct path from Internet to internal components if rules aren’t configured perfectly. Anti-spoofing helps verify legitimate sources, not the presence of direct Internet paths to the CDE. Documentation and approvals govern what services are allowed, not the fundamental rule about direct Internet access to CDE components.