How should a shared hosting provider's protection of hosted environments be verified?

• A. Review a single server
• B. Trust the provider's attestations
• C. Verify protection by auditing external perimeter
• D. Select a sample of servers across a representative sample of hosted merchants and service providers

Answer: (D)

Verifying protection in a shared hosting environment must be evidence across the whole ecosystem, not just one point. In shared hosting, many tenants share infrastructure, so protections need to be demonstrably in place across multiple servers and configurations. Relying on attestations alone can be risky, as they may be outdated or not fully representative, and auditing only the external perimeter misses internal controls that separate tenants and protect data. By auditing a sample of servers across a representative set of hosted merchants and service providers, you obtain real-world evidence that protective controls are consistently applied across the environment, capturing variability in configurations and use cases. This approach gives a practical, scalable view of how well protections work in practice.