What is required regarding perimeter firewalls between wireless networks and the CDE?

• A. There should be no perimeter firewall between wireless networks and the CDE.
• B. Perimeter firewalls must deny or permit only authorized traffic between the wireless environment and the CDE.
• C. Perimeter firewalls should log but not filter traffic.
• D. Examine firewall configurations to verify that perimeter firewalls are installed between all wireless networks and the CDE and that only authorized traffic is allowed.

Answer: (D)

The key idea is that the boundary between wireless networks and the Cardholder Data Environment must be protected with a perimeter firewall, and its rules must be verified to allow only authorized traffic. This means you not only have a firewall separating the wireless environment from the CDE, but you also confirm through examination that the firewall is in place on every wireless-to-CDE path and that the rule set permits only what is explicitly authorized. Verification steps might include reviewing firewall configurations, rule bases, and evidence that the boundary is enforced, ensuring default-deny or explicit-deny behavior for any unauthorized traffic.

This is stronger than saying only that authorized traffic can cross—verification of both presence and proper configuration is essential for assurance. It’s also not sufficient to rely on logging alone, since filtering is the actual control that prevents unauthorized access. And claiming there should be no perimeter firewall contradicts the fundamental requirement to segment and protect the CDE from wireless exposure.