PCI SSCPCI DSSVulnerability MgmtEASYFree question
What does PCI DSS Requirement 5 address?
- A.Network segmentation, which PCI DSS never mandates but which, once implemented and verified by testing, can shrink the number of systems in scope for assessment
- B.Protecting all systems and networks from malicious software (malware)
- C.Data encryption, named in Requirement 3.6.1 as a component of the documented key-management architecture
- D.Access control
Why B is correct
Requirement 5 focuses on protecting all systems and networks from malicious software through antivirus/anti-malware solutions and related controls.
Know someone studying for PCI DSS? Send them this one.