Which statement describes the DMZ’s purpose to limit inbound traffic to authorized publicly accessible services, protocols, and ports?

• A. Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.
• B. Limit inbound Internet traffic to IP addresses within the DMZ.
• C. Prohibit direct public access between Internet and CDE.
• D. Do not allow unauthorized outbound traffic from CDE to Internet.

Answer: (A)

A DMZ is a buffer zone that exposes only what must be reachable from the Internet. The statement describes implementing the DMZ to ensure inbound traffic from the Internet is allowed only to the systems in the DMZ that provide publicly accessible services, using only the authorized protocols and ports. This containment keeps direct access to the internal Cardholder Data Environment from the Internet, reducing exposure and risk.

Other ideas miss that service- and port-level control or focus on aspects like IP-based filtering, direct Internet access to internal networks, or outbound restrictions, which aren’t the central point of why a DMZ is used.