Which statement best describes anti-spoofing measures?

• A. Anti-spoofing measures are optional.
• B. Anti-spoofing measures can be replaced by simple password protection.
• C. Anti-spoofing measures do not address forged IP addresses.
• D. Examine firewall and router configurations to verify that anti-spoofing measures are implemented to detect and block forged source IP addresses from entering the network.

Answer: (D)

Anti-spoofing measures are about preventing packets that use a forged source IP address from entering or moving through the network. They’re typically implemented at the network edge on devices like firewalls and routers, using rules or features (such as ingress/egress filtering and anti-spoofing checks) to drop or block suspicious traffic whose source IP doesn’t match where it’s coming from.

This option is best because it directly describes putting these controls in place on the network devices that see and filter traffic, and then verifying those configurations to ensure the protections are actually active. It captures the practical, defense-in-depth approach of PCI DSS: you don’t rely on usernames or passwords to stop IP spoofing; you enforce network-layer checks at the point where traffic enters the network.

The other statements miss the core idea. Anti-spoofing isn’t optional, and security measures like anti-spoofing complement but do not replace password protection. And anti-spoofing specifically addresses forged (spoofed) source IP addresses, so saying it doesn’t address forged IPs would be incorrect.