PCI Fundamentals Practice Test

In PCI DSS, scoping hinges on what actually stores, processes, or transmits cardholder data or is connected to those systems. You only exclude parts of the network after you have verified that the segmentation really works and blocks CHD from crossing boundaries. If you exclude a network segment without proving it’s effectively isolated, you’re basing the scope on an untested assumption. That means there could be hidden paths for cardholder data or gaps in security controls, leaving parts of the environment out of proper protection and out of the assessment.

Other options miss the need for evidence of separation or over-restrict in ways that aren’t justified by validated controls, which is why excluding unverified segments represents a poorer scoping decision.