hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: The security architect for a mid-sized e-commerce…
You are the security architect for a mid-sized e-commerce company that processes credit card payments. The company must comply with PCI DSS. Currently, the cardholder data environment (CDE) includes a web server, an application server, and a database server, all on the same flat network segment. The QSA has identified that the CDE is not properly segmented, and network access controls are insufficient. The company wants to minimize the scope of PCI compliance by reducing the number of systems that handle cardholder data. You propose implementing network segmentation to isolate the CDE. Which of the following is the most effective approach to reduce PCI scope while maintaining business functionality?
⚠ Common exam trap
Watch out — candidates often confuse data-centric controls (like encryption or tokenization) with network-centric controls (like segmentation), leading them to choose options that protect data but do not reduce the number of systems in the CDE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a firewall between the CDE and corporate network, allowing only necessary traffic
Deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all cardholder data at rest and in transit
Why it's wrong here
Encryption does not remove systems from scope
- ✗
Replace the database with a tokenization service and remove the database from the CDE
Why it's wrong here
Tokenization can reduce scope but the question is about segmentation
- ✗
Move all servers to a DMZ and implement host-based firewalls
Why it's wrong here
Still in scope if they handle cardholder data
- ✓
Deploy a firewall between the CDE and corporate network, allowing only necessary traffic
Why this is correct
Segmenting the CDE reduces scope
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.