What does 1.3 prohibit regarding direct public access?

• A. There must be no direct access between Internet and CDE components.
• B. Direct Internet access is allowed if traffic is filtered.
• C. DMZ must be used.
• D. Public access is allowed for scalability.

Answer: (A)

Direct public access from the Internet to the cardholder data environment is prohibited. The idea is to keep the CDE hidden behind a controlled boundary so that all traffic to and from the CDE must pass through security controls like firewalls or other network segmentation devices. This minimizes exposure and reduces the risk if Internet-facing systems are compromised.

DMZs can be used as a buffer to host Internet-facing services, but they aren’t mandatory and aren’t a loophole around this rule. Saying that direct Internet access is allowed if traffic is filtered or that public access is needed for scalability contradicts the prohibition on direct access to the CDE.