PCI DSS requires which of the following as part of the penetration-testing process?

The correct answer is B. The network must be segmented. PCI DSS most certainly requires segmentation. PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective, and isolate all out-of-scope systems from systems in the 2.2.3 Testing Segmentation Controls The…

Planning and Scoping

Question

Options

AThe penetration tester must have cybersecurity certifications.
BThe network must be segmented.
COnly externally facing systems should be tested.
DThe assessment must be performed during non-working hours.

How the community answered

(37 responses)

B
95% (35)
C
3% (1)
D
3% (1)

Explanation

PCI DSS most certainly requires segmentation. PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective, and isolate all out-of-scope systems from systems in the 2.2.3 Testing Segmentation Controls The intent of segmentation is to prevent out-of-scope systems from being able to communicate with systems in the CDE or impact the security of the CDE. When properly implemented, a segmented (out-ofscope) system component could not impact the security of the CDE, even if an attacker obtained control.

Topics

#PCI DSS#Penetration Testing#Network Segmentation#Regulatory Compliance

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice