Network Security & Architecture Flashcards

What is the primary focus of PCI DSS Requirement 1?

Answer: Installing and maintaining network security controls

PCI DSS Requirement 1 specifically addresses the installation and maintenance of network security controls to protect the cardholder data environment.

Under PCI DSS, what is required between the internet and the cardholder data environment (CDE)?

Answer: A DMZ with network security controls on both sides

PCI DSS requires a DMZ with network security controls between the internet and the DMZ, and between the DMZ and the CDE, providing layered protection.

Which wireless encryption protocol does PCI DSS prohibit due to well-known cryptographic weaknesses?

Answer: WEP (Wired Equivalent Privacy)

WEP has fundamental cryptographic flaws that allow attackers to recover the encryption key within minutes, making it prohibited under PCI DSS.

What must be included in network diagrams maintained for PCI DSS compliance?

Answer: All network connections and all cardholder data flows

PCI DSS requires comprehensive network diagrams showing all connections between system components and all cardholder data flows within the CDE.

Under PCI DSS, which traffic rule principle must all network security controls protecting the CDE enforce?

Answer: Implicit deny — block all traffic not explicitly permitted

PCI DSS requires an implicit deny posture, meaning only explicitly authorized traffic is allowed and everything else is blocked by default.

What is the PCI DSS requirement regarding vendor default settings for newly deployed network devices?

Answer: All vendor-supplied defaults must be changed before deployment

PCI DSS Requirement 2 mandates that all vendor-supplied defaults — including passwords and security parameters — must be changed before any system is placed in production.

How does network segmentation primarily benefit a PCI DSS compliance program?

Answer: It reduces the scope of the PCI DSS assessment

Effective network segmentation isolates the CDE from other networks, reducing the number of system components subject to PCI DSS assessment and thereby shrinking compliance scope.