Which statement mandates installing perimeter firewalls between wireless networks and the cardholder data environment and allowing only authorized traffic?

• A. Limit inbound Internet traffic to IP addresses within the DMZ.
• B. Install perimeter firewalls between all wireless networks and the cardholder data environment, and configure these firewalls to deny or, if traffic is necessary for business purposes, permit only authorized traffic between the wireless environment and the cardholder data environment.
• C. Prohibit direct public access between Internet and any system component in the cardholder data environment.
• D. Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.

Answer: (B)

Protecting the cardholder data environment is about creating controlled network boundaries with firewalls and enforcing access rules at those boundaries. Wireless networks can be easily exposed, so PCI DSS expects a perimeter firewall between any wireless network and the cardholder data environment. By placing this firewall, you block unwanted traffic by default and only allow traffic that is truly necessary for business.

The statement that mandates installing perimeter firewalls between all wireless networks and the cardholder data environment and configuring these firewalls to deny traffic by default, permitting only authorized traffic when needed, directly reflects this requirement. It embodies the principle of least privilege and ensures a managed, auditable boundary between wireless segments and sensitive data.

Other options touch on general security controls—limiting inbound Internet traffic, prohibiting public access to the Internet, or restricting outbound traffic from the CDE—but they do not specify the mandatory boundaryFirewall setup between wireless networks and the CDE, which is the key requirement here.