Which of the following are examples of open, public networks where CHD must be protected in transit?

• A. The Internet; Wireless technologies; Cellular technologies; Satellite communications
• B. Private LAN; Intranet; VPN; LAN
• C. Email within corporate network only
• D. USB connections

Answer: (A)

Open, public networks are paths not under the organization’s control and accessible by the public. Examples include the Internet, wireless networks, cellular networks, and satellite links. Because these paths can be monitored or intercepted, PCI DSS requires encryption to protect cardholder data in transit over them. That’s why the best answer lists The Internet; Wireless technologies; Cellular technologies; Satellite communications.

The other options describe environments that are private or non-network media. A private LAN, intranet, VPN, or LAN is within the organization’s control, not an open public path. Email within a corporate network stays inside the private perimeter, and USB connections are not networks at all. These do not illustrate open/public networks requiring in-transit encryption under PCI DSS.