What is the primary objective of PCI DSS Requirement 1?

• A. Establish a documented incident response plan.
• B. Encrypt all data at rest.
• C. Install & maintain a firewall configuration to protect cardholder data.
• D. Monitor network activity continuously.

Answer: (C)

The main idea is to create a secure boundary for the cardholder data environment by controlling network traffic with a firewall. Requirement 1 focuses on installing and maintaining a firewall configuration that sits between untrusted networks (like the Internet) and the networks that handle cardholder data, and enforcing access controls between segments. This means documenting rules, restricting inbound and outbound traffic to only what is necessary, and keeping firewall configurations up to date so unauthorized connections to the cardholder data environment are blocked.

Why this is the best fit among the options: it directly addresses building a protective barrier around where cardholder data flows, which is the foundational network security control for PCI DSS. The other options involve incident response planning, encryption of data at rest, and continuous monitoring—important security activities, but they are not the primary objective of firewall configuration.