An entity accepts e-commerce payment card transactions and stores account data in a database. The database server and the web server are both…

​ Protecting the Database Server

PCI DSS v4.0 requires that systems storing cardholder data, such as database servers, must not be

directly accessible from untrusted networks (Requirement 1.3).

The database server should be behind network security controls like firewalls and placed in a

segmented network isolated from untrusted networks​​.

​ Segmentation Best Practices

The web server, which interfaces with external users, can remain accessible from the Internet but

should reside in a DMZ to prevent direct access to the internal network.

This separation protects the database server from external threats while maintaining system

functionality​​.

​ Incorrect Options

Option A: Combining the web and database servers increases the attack surface and violates best

practices.

Option C: Moving the web server to the internal network exposes the internal environment.

Option D: Segmentation is critical, but the reason is not solely to allow more concurrent connections.