Which statement describes requirements for a firewall at each Internet connection and between any DMZ and the internal network?

• A. Requirements for a firewall at each Internet connection and between any demilitarized zone (DMZ) and the internal network.
• B. Documentation and business justification and approval for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure.
• C. Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.
• D. Limit inbound Internet traffic to IP addresses within the DMZ.

Answer: (A)

This question focuses on how firewall placement enforces network segmentation for cardholder data. The requirement is to have a firewall at each Internet connection and a separate firewall boundary between the DMZ and the internal network. Placing firewalls at these boundaries creates deliberate, tightly controlled chokepoints that protect the cardholder data environment by ensuring traffic from untrusted networks (the Internet) is inspected before it can reach internal systems, and that traffic moving from the DMZ to the internal network is explicitly restricted.

This exact boundary setup is what PCI DSS calls for, because the DMZ serves as a buffer for public-facing services, and the internal network houses sensitive data. By enforcing distinct firewall controls at these two boundaries, organizations reduce the risk of unauthorized access and limit the potential impact of any compromise.

The other options either focus on documentation or policy rather than concrete network boundary controls, or describe less precise rules (such as limiting inbound traffic only to DMZ addresses) that don’t capture the mandated firewall segmentation between Internet connections, DMZ, and the internal network.