PCI SSCPCI DSSVulnerability MgmtEASYFree question
How must public-facing web applications be protected according to PCI DSS?
- A.Through an intrusion prevention system (IPS) placed behind the load balancer in the DMZ, with signatures reviewed on a quarterly schedule by the QSA
- B.Through a network security control (NSC) that blocks inbound ports other than 443 at the perimeter, with rule reviews held twice a year by the QSA
- C.Through either a web application firewall (WAF) or regular application vulnerability assessments, with vulnerabilities addressed promptly
- D.Through quarterly external scans by an ASV (Approved Scanning Vendor) on the public IP range, with failed findings rescanned until a passing result is reached
Why C is correct
Public-facing web applications must be protected by a WAF or through regular vulnerability assessments with prompt remediation of identified issues.
Know someone studying for PCI DSS? Send them this one.