PCIP Security Technologies & Network Architecture 2 — Questions and Answers
Question 1: Which network segmentation approach most effectively reduces PCI DSS scope by isolating the cardholder data environment (CDE)?
- Using VLANs alone to separate CDE traffic
- Implementing firewall-enforced network segmentation with documented access controls (Correct answer)
- Placing all servers on a single flat network with host-based firewalls only
- Using MAC address filtering to restrict CDE access
Correct answer: Implementing firewall-enforced network segmentation with documented access controls
PCI DSS requires firewall-enforced segmentation with documented controls to isolate the CDE and reduce scope; VLANs alone are insufficient without enforced access policies.
Question 2: An IDS detects a port scan originating from within the internal network toward CDE systems. What is the FIRST appropriate response under PCI DSS incident response requirements?
- Immediately block all internal traffic to the CDE
- Contain the potential threat, preserve evidence, and notify the security team per the incident response plan (Correct answer)
- Reboot the CDE systems to clear any potential compromise
- Submit a SAQ to the card brands immediately
Correct answer: Contain the potential threat, preserve evidence, and notify the security team per the incident response plan
PCI DSS Requirement 12.10 mandates following a documented incident response plan that includes containment and evidence preservation as initial steps.
Question 3: What is the primary purpose of a demilitarized zone (DMZ) in a PCI DSS-compliant network architecture?
- To store cardholder data for easier access by employees
- To host public-facing systems while preventing direct access to the internal network and CDE (Correct answer)
- To replace the need for intrusion detection systems
- To serve as the primary backup location for encryption keys
Correct answer: To host public-facing systems while preventing direct access to the internal network and CDE
A DMZ isolates public-facing components (web servers, payment gateways) from the internal network, preventing attackers who compromise DMZ systems from directly reaching the CDE.
Question 4: Under PCI DSS, which protocol should be used for remote administrative access to CDE systems?
- Telnet with strong passwords
- FTP with TLS encryption
- SSH or TLS with multi-factor authentication (Correct answer)
- SNMP v2c with community strings
Correct answer: SSH or TLS with multi-factor authentication
PCI DSS Requirement 8.6 prohibits insecure protocols like Telnet and requires encrypted protocols such as SSH or TLS with MFA for remote administrative access to CDE.
Question 5: A retailer uses a point-to-point encryption (P2PE) solution validated by PCI SSC. What is the primary PCI DSS scope reduction benefit?
- No PCI DSS requirements apply to the merchant at all
- Card data is encrypted at the point of interaction, so systems that handle only encrypted data may be descoped (Correct answer)
- The merchant's SAQ level automatically reduces to SAQ A
- All network segmentation requirements are waived
Correct answer: Card data is encrypted at the point of interaction, so systems that handle only encrypted data may be descoped
Validated P2PE solutions encrypt card data at the terminal, so downstream systems that only process ciphertext are generally out of scope, reducing the merchant's compliance footprint.
Question 6: Which of the following is a key requirement for wireless networks that connect to the CDE or transmit cardholder data under PCI DSS?
- WEP encryption is acceptable if a strong passphrase is used
- WPA2 or WPA3 with AES encryption must be used (Correct answer)
- Wireless networks must be physically separated but no encryption standard is specified
- Only enterprise-grade hardware is required with no specific encryption mandate
Correct answer: WPA2 or WPA3 with AES encryption must be used
PCI DSS Requirement 4.2 mandates strong cryptography for wireless transmissions involving cardholder data, with WPA2/WPA3 using AES being the accepted standard.
Question 7: What does the principle of 'defense in depth' mean in the context of PCI DSS network architecture?
- Using a single, highly sophisticated firewall to block all threats
- Implementing multiple overlapping security controls so that if one fails, others continue to protect the CDE (Correct answer)
- Encrypting all data at rest with a single encryption key
- Relying solely on endpoint antivirus for CDE protection
Correct answer: Implementing multiple overlapping security controls so that if one fails, others continue to protect the CDE
Defense in depth means layering firewalls, IDS/IPS, access controls, encryption, and monitoring so no single point of failure exposes the CDE.
PCIP Security Technologies & Network Architecture 2
Which network segmentation approach most effectively reduces PCI DSS scope by isolating the cardholder data environment (CDE)?