Which statement about Network Segmentation is true?

• A. It is a PCI DSS requirement.
• B. It isolates components that store, process, or transmit cardholder data from those that do not.
• C. It increases the scope of the PCI DSS assessment.
• D. It is identical to creating a Network Diagram.

Answer: (B)

Network segmentation isolates the parts of the network that store, process, or transmit cardholder data from the parts that do not. By putting cardholder data environments on a separate segment, you limit where PCI DSS controls must be applied, which reduces the scope of the PCI DSS assessment and makes security management more focused. It also reduces risk because systems outside the segmented area cannot reach cardholder data without crossing explicit controls, so an attacker would have to breach that boundary to access sensitive data.

This approach is a technique to achieve PCI DSS goals, not a standalone requirement by itself. It doesn’t increase scope; it typically reduces it. And while a Network Diagram can help you design segmentation, the diagram itself is not the segmentation—it's just a planning tool.