Which networks should be monitored by IDS/IPS during security testing?

• A. Perimeter of the CDE and critical points in the CDE
• B. Only internal network
• C. Employee activity
• D. Only external traffic

Answer: (A)

The key idea is to place IDS/IPS where the cardholder data environment is most at risk: at the network boundaries and at critical internal points where sensitive data flows pass. Monitoring the perimeter of the CDE captures traffic entering and leaving the environment, including attempts from external attackers, while also watching essential internal junctions—such as segmentation devices, core routers, and switches that connect with sensitive segments—to detect lateral movement and data exfiltration. If you focus only on the internal network, you could miss attackers coming from outside; if you monitor only external traffic, you might miss threats that have already penetrated and are moving within the CDE. Employee activity isn’t the primary focus of network IDS/IPS monitoring, which targets network traffic patterns and known threat signatures. By concentrating on the perimeter and critical internal points within the CDE, you achieve visibility where it matters most for protecting cardholder data.