Question

A retail company processes credit card transactions across a single large network where point-of-sale (POS) terminals, corporate workstations, and back-office servers all share the same broadcast domain. A security assessment recommends reducing the number of systems subject to PCI DSS controls while limiting the blast radius of any compromise. Which segmentation approach BEST achieves this goal?

Accepted Answer

Isolate the POS terminals and cardholder data systems into a dedicated segment with strict firewall rules between it and all other network zones

Answer

Deploy host-based antivirus on every POS terminal and corporate workstation to prevent malware spread across the flat network

Answer

Assign the POS terminals static IP addresses so they can be easily tracked during the annual audit

Answer

Enable full-disk encryption on the back-office servers to protect stored cardholder data at rest