Scope a cardholder environment and assemble the evidence pack

applied · 80 min · Objective 1.10

Task

Apply objective 1.10: scope a payment environment down deliberately, then assemble the evidence an assessor actually asks for -- which is the part a candidate is genuinely expected to be able to produce.

Steps

  1. Write lab/pci-scope.md describing the estate, the designated environment, and every CONNECTION into it enumerated by name.
  2. Reduce the scope by two deliberate moves -- stop storing something, tokenise something, segment something -- and record the before and after count of in-scope systems.
  3. State how you would TEST the segmentation, not assert it, and run that test: attempt a connection that should be denied and capture the refusal in lab/pci-segmentation-test.txt.
  4. Assemble lab/pci-evidence/ containing an asset inventory for the scope, configuration proof for two requirements, an access review export, and a log retention statement.
  5. Write lab/pci-note.md naming which requirement families your scope reduction removed entirely.

Verify

grep -Ec 'connection|ingress|egress' lab/pci-scope.md
grep -Ec '[0-9]+' lab/pci-scope.md
test -s lab/pci-segmentation-test.txt && echo "segmentation tested"
ls lab/pci-evidence/ | wc -l
grep -Eci 'storage|no longer store|token' lab/pci-note.md

Connections enumerated, before/after counts present, a captured refusal from the segmentation test, and four or more evidence artefacts. A scope claimed without a tested segmentation is the scope an assessor will not accept.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.