Exam PT0-002 topic 1 question 157 discussion

PCI DSS most certainly requires segmentation. PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective, and isolate all out-of-scope systems from systems in the CDE. 2.2.3 Testing Segmentation Controls The intent of segmentation is to prevent out-of-scope systems from being able to communicate with systems in the CDE or impact the security of the CDE. When properly implemented, a segmented (out-ofscope) system component could not impact the security of the CDE, even if an attacker obtained control of the out-of-scope system

I think B is correct

B. The network must be segmented. Explanation: B. The network must be segmented: • PCI DSS Requirement 11.3 specifies that penetration testing must be conducted to identify and exploit vulnerabilities that could be used to compromise the security of the cardholder data environment (CDE). One of the key requirements is to ensure that the CDE is segmented from other networks to reduce the scope of PCI DSS requirements and limit exposure.

I think it is B not A because - Certifications held by a penetration tester may be an indication of the skill level and competence of a potential penetration tester or company. While these are not required certifications, they can indicate a common body of knowledge held by the candidate. not C - pentest should also assess internal systems to be sure, that it does not contain hidden vulnerabilities not D - time is part of the a agreement, PCI does not specify time

The Payment Card Industry Data Security Standard (PCI DSS) outlines various requirements for protecting cardholder data. Among the options listed, the one that aligns with PCI DSS as part of the penetration-testing process is: B. The network must be segmented. Explanation: Option B: Network segmentation is a common practice to isolate different parts of the network and minimize the risk of unauthorized access to sensitive areas, such as those that handle cardholder data. PCI DSS requires network segmentation as a way to reduce the scope of the PCI environment, making it easier to secure and comply with the standard.

Answer B segmentation is very importent part of pentest

The best answer is C. PCI DSS requires that only externally facing systems should be tested as part of the penetration-testing process.

bbbbbbbbb

B is correct

The network doesn't have to be segmented. It has to be both internal and external. It doesn't the time of day.