Which approach minimizes risk by separating cardholder data from untrusted networks?

• A. Place cardholder data components in the DMZ
• B. Store them in the public internet
• C. Use vendor default cloud storage
• D. Place cardholder data components in the internal network zone segregated from DMZ and untrusted networks

Answer: (D)

The idea being tested is isolating cardholder data through network segmentation so the card data environment stays in a trusted, internal zone away from untrusted networks. Keeping the CHD components inside an internal network zone that is segregated from the DMZ and other untrusted networks limits who can access the data and how it can flow. This tight boundary allows stronger access controls, monitoring, and enforcement of security policies, reducing the chance of exposure if other parts of the network are compromised.

Placing CHD in the DMZ would expose it to traffic from untrusted networks, increasing risk and expanding the attack surface. Storing CHD on the public internet is inherently insecure and incompatible with prudent risk management. Relying on vendor default cloud storage can introduce misconfigurations or multi-tenant risks that undermine proper separation. The segregated internal-zone approach provides the necessary containment to protect CHD while still enabling legitimate, supervised access.