What is the objective of 1.2 regarding untrusted networks?

• A. Only allow outbound connections to the Internet from CHD.
• B. Allow DMZ to internal network unrestricted.
• C. Build firewall & router configurations that restrict connections between untrusted networks and any system components in the CDE.
• D. Allow all traffic from untrusted networks to the CDE.

Answer: (C)

The main idea is to prevent direct access from networks you don’t control (untrusted networks, like the Internet) to anything in the cardholder data environment. The objective is to design firewall and router configurations that restrict connections between these untrusted networks and every system component in the CDE, so only the minimum必要 services and paths are allowed and everything else is blocked. This segmentation reduces the attack surface and helps ensure that cardholder data isn’t exposed to external networks.

Why this is the best choice: it aligns with the goal of tightly controlling network access to the CDE, using firewalls and routers to enforce boundaries and least-privilege connectivity.

Why the other options don’t fit: they either imply unrestricted access from untrusted networks, focus only on outbound Internet traffic without protecting the CDE, or claim that internal networks can be exposed to untrusted networks—none of which meet the requirement to restrict and control connections to the CDE.