PCI SSCPCI DSSVulnerability MgmtEASYFree question
Where must anti-malware solutions be deployed according to PCI DSS?
- A.On all CDE servers, workstations, firewalls, routers, switches, HSMs, plus any laptops that connect to the network remotely
- B.On all systems except Linux hosts, whose operating systems are exempt from Requirement 5
- C.On all systems commonly affected by malware, particularly those running operating systems susceptible to malware
- D.On all systems in the DMZ, including web servers, mail gateways, external DNS hosts
Why C is correct
Anti-malware must be deployed on all systems commonly affected by malware, especially those with operating systems known to be susceptible to malicious software.
Know someone studying for PCI DSS? Send them this one.