Question

A retail client hires your firm to perform a penetration test to satisfy an annual PCI DSS requirement. During scoping, the client states that their cardholder data environment (CDE) is isolated from the corporate network by firewalls and VLAN segmentation. To properly define the scope of the engagement in line with PCI DSS guidance, which action should the penetration tester prioritize?

Accepted Answer

Include segmentation checks that verify the isolation controls actually prevent access from out-of-scope networks into the CDE

Answer

Limit testing strictly to the systems the client identifies as being inside the CDE to avoid touching out-of-scope assets

Answer

Test only the corporate network, since the CDE is already protected by firewalls and does not need validation

Answer

Exclude all network testing and rely on the client's self-attestation that segmentation is properly configured