Define the payment assessment boundary

Objectives

Encode the mandatory fixture decisions in YAML Ain’t Markup Language (YAML), a structured text format. True means in scope for the named component. The office exclusion field has the opposite meaning.

This exercise checks a declared boundary, not the actual effectiveness of segmentation or real-world compliance.

Copper Finch is a merchant, not a service provider. Service: ticket payments.
PAN is stored in the payment database; the payment API processes PAN.
The admin jump host, identity service and deployment runner administer or change payment systems.
The segmentation firewall enforces the CDE boundary.
The office network has no other CDE connection or security influence; independent isolation tests cover every relevant path and confirm effective isolation. Exclude it on the basis "tested isolation".
Sensitive authentication data must not be stored after authorization.
Provider: Cedar Token Processing. A provider responsibility record is required.
The acquirer requires ROC validation. Confirm scope every 12 months and on significant change.
Test segmentation every 12 months and after changes. This is a merchant fixture, not a service-provider frequency exercise.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Include the payment data systems

   Mark payment API and database in scope.

   Include the payment data systems

2. Step 2

   Include security-impacting dependencies

   Include the jump host, identity service, deployment runner and segmentation firewall.

   Include security-impacting dependencies

3. Step 3

   Justify the office network exclusion

   Use the fixture isolation evidence and explicit exclusion basis.

   Justify the office network exclusion

4. Step 4

   Record storage and prohibit post-authorization SAD

   Identify PAN storage and reject retention of sensitive authentication data after authorization.

   Record storage and prohibit post-authorization SAD

5. Step 5

   Retain provider responsibility evidence

   Name the provider and retain a responsibility record rather than transferring all duties.

   Retain provider responsibility evidence

6. Step 6

   Set the required route and review triggers

   Use ROC, annual scope and segmentation intervals, and both change triggers.

   Set the required route and review triggers

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.