Where should system components that store cardholder data be placed?

• A. In the DMZ
• B. On the public internet
• C. In an internal network zone segregated from the DMZ and other untrusted networks
• D. In an external vendor network

Answer: (C)

The idea is to minimize exposure of cardholder data by using network segmentation. System components that store cardholder data should reside in a tightly controlled internal network zone that is clearly separated from less trusted segments, such as the DMZ and any networks connected to the public or external sources. The DMZ is designed for systems that must be reachable from the internet, like web servers, and placing storage there would create more pathways for attackers to access sensitive data. Similarly, putting data in the public internet or an external vendor’s network would increase exposure and PCI scope, making it harder to enforce strict access controls and monitoring. By keeping storage in an internal, segregated zone, you limit who and what can reach the data, apply stronger controls between zones (firewalls, access restrictions, encryption), and reduce the risk if other parts of the network are compromised.