Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.

Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.

• A. Allow direct connections inbound or outbound for access to the CDE
• B. Route all Internet-bound traffic through the DMZ
• C. Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment
• D. Enable direct connections via a public gateway

Answer: (C)

The idea being tested is keeping the cardholder data environment isolated from direct Internet access. The best choice states that you must not allow any direct connections inbound or outbound between the Internet and the CDE. This ensures the CDE is protected by defined, monitored boundaries (like firewalls and segmentation) so that any access to or from the Internet must pass through controlled, inspectable paths rather than being a direct, unfiltered connection. This minimizes exposure and helps enforce strict access controls, logging, and monitoring. Allowing direct access would create an unfiltered attack surface. Routing all Internet-bound traffic through a DMZ is a common design pattern, but by itself it doesn’t guarantee that there are no direct paths into the CDE if misconfigurations occur. Enabling direct connections via a public gateway similarly bypasses the protective segmentation PCI DSS requires.

The idea being tested is keeping the cardholder data environment isolated from direct Internet access. The best choice states that you must not allow any direct connections inbound or outbound between the Internet and the CDE. This ensures the CDE is protected by defined, monitored boundaries (like firewalls and segmentation) so that any access to or from the Internet must pass through controlled, inspectable paths rather than being a direct, unfiltered connection. This minimizes exposure and helps enforce strict access controls, logging, and monitoring.

Allowing direct access would create an unfiltered attack surface. Routing all Internet-bound traffic through a DMZ is a common design pattern, but by itself it doesn’t guarantee that there are no direct paths into the CDE if misconfigurations occur. Enabling direct connections via a public gateway similarly bypasses the protective segmentation PCI DSS requires.