You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You…

Question

Options

• AUse multi-factor authentication for admin access to the web application.
• BUse only applications certified compliant with PA-DSS.
• CMove the cardholder data environment into a separate GCP project.
• DUse VPN for all connections between your office and cloud environments.

• A
  6% (2)
• B
  3% (1)
• C
  81% (29)
• D
  11% (4)

Explanation

Moving the cardholder data environment (CDE) into a separate GCP project (C) is the correct approach. PCI DSS audit scope is determined by where cardholder data flows and what systems can interact with it. By isolating the CDE in a dedicated project with strict network boundaries, you ensure that web servers, data processing pipelines, and other non-CDE systems in the original project are no longer in scope for PCI audits. MFA for admin access (A) is a good practice but does not reduce scope. PA-DSS certified apps (B) applies to payment software vendors, not to your infrastructure scope. VPN for office connectivity (D) secures transit but does not isolate cardholder data from other systems in the same project.

No community discussion yet for this question.