Which statement implements anti-spoofing measures to detect and block forged source IP addresses from entering the network?

• A. Limit inbound Internet traffic to IP addresses within the DMZ.
• B. Prohibit direct public access between Internet and CDE.
• C. Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.
• D. Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network.

Answer: (D)

Anti-spoofing is about ensuring that packets entering the network have legitimate source IPs and stopping forged addresses before they reach sensitive systems. Implementing anti-spoofing means using edge filtering and verification techniques so that traffic with spoofed source addresses is dropped at the perimeter. This directly reduces the risk of attackers using fake IPs to access the network, evade controls, or overwhelm systems, and it helps ensure traffic that reaches the cardholder data environment comes from trusted sources.

This makes it the best choice because it targets the specific threat of forged source IPs and describes the practical action of detecting and blocking that bad traffic. The other options describe general security practices like restricting inbound traffic to DMZ IPs, preventing direct public access to the CDE, or blocking unauthorized outbound traffic, which are important but do not address spoofed source addresses themselves.