Which architecture best prevents direct public access from Internet to internal cardholder network components?

Which architecture best prevents direct public access from Internet to internal cardholder network components?

• A. Direct Internet access to internal cardholder components is allowed if ports are closed.
• B. The DMZ should be used to host all internal components.
• C. Direct access is allowed via VPN.
• D. Use a choke router and DMZ to ensure there is no direct access from the Internet to internal components.

Answer: (D)

Preventing direct exposure of the cardholder data environment to the Internet relies on placing a buffer between public networks and the sensitive systems and routing all access through a controlled point. A DMZ acts as that buffer, hosting only services that must be reachable from the Internet while keeping the core cardholder components behind stronger controls. A choke router creates a single chokepoint so all traffic from the Internet passes through a known, inspectable path, allowing precise firewall rules and logging before anything reaches internal components. This layered setup minimizes the attack surface and provides clear, enforceable boundaries, which is the strongest protection for PCI DSS requirements. Direct Internet access to internal components—even with ports supposedly closed—can be compromised through misconfigurations, new services, or overlooked paths. Placing all internal components in the DMZ would unnecessarily expose sensitive systems to the Internet. Direct access via VPN can be a legitimate way to enable remote work, but it still establishes a path from the Internet into internal resources; the choke router plus DMZ architecture specifically prevents direct exposure by design and enforces a controlled boundary.

Preventing direct exposure of the cardholder data environment to the Internet relies on placing a buffer between public networks and the sensitive systems and routing all access through a controlled point. A DMZ acts as that buffer, hosting only services that must be reachable from the Internet while keeping the core cardholder components behind stronger controls. A choke router creates a single chokepoint so all traffic from the Internet passes through a known, inspectable path, allowing precise firewall rules and logging before anything reaches internal components. This layered setup minimizes the attack surface and provides clear, enforceable boundaries, which is the strongest protection for PCI DSS requirements.

Direct Internet access to internal components—even with ports supposedly closed—can be compromised through misconfigurations, new services, or overlooked paths. Placing all internal components in the DMZ would unnecessarily expose sensitive systems to the Internet. Direct access via VPN can be a legitimate way to enable remote work, but it still establishes a path from the Internet into internal resources; the choke router plus DMZ architecture specifically prevents direct exposure by design and enforces a controlled boundary.