What should you observe about firewalls relating to internet connections and DMZ per 1.1.4?

• A. There is a firewall at each internet connection and between DMZ and internal network, per standards.
• B. Firewalls are optional for DMZ.
• C. The DMZ has no firewall.
• D. Internal network has no firewall.

Answer: (A)

In PCI DSS, protecting network boundaries and isolating segments is essential. The requirement states that a firewall must be in place at every Internet connection and also between the DMZ and the internal network. This creates a security barrier: traffic from the Internet passes through a firewall first, and traffic from the DMZ to the internal network is filtered by another firewall. This layering helps prevent attackers who compromise a DMZ host from directly reaching the internal network or the cardholder data environment.

This is why the best answer is that there is a firewall at each Internet connection and between DMZ and internal network. Firewalls are not optional for the DMZ, the DMZ must be separated from the internal network by a firewall, and the internal network should also be protected by a firewall.