PCI SSCPCI DSSScoping SegmentationEASYFree question
What are 'connected-to' systems in PCI DSS scoping?
- A.Systems that hold encrypted cardholder data in a database but lack access to the decryption keys held elsewhere
- B.Systems that connect to or communicate with CDE systems but do not directly handle cardholder data
- C.Systems that process cardholder data but belong to a third-party service provider
- D.Systems that sit on the internet edge but have no route to the payment network
Why B is correct
Connected-to systems communicate with the CDE through network connections or other means but do not directly store, process, or transmit cardholder data. They are in scope because they could impact CDE security.
Know someone studying for PCI DSS? Send them this one.