Free quiz · Appendix B of Book 4 · Retail
Score your store network diagram
Open your current drawing, the real one. Pick one answer per question.
(a) is worth 5, (b) is worth 2, (c) is worth 0. Pick the answer that is true right now.If you have to think about it, it's (b) at best. Verbal knowledge doesn't count. If the answer lives in your head and not on the page, it's (c).Check, don't remember. Look at one real device or cable and compare.This is the retail scorecard from Book 4, Draw Secure Retail Network Diagrams Pick another industry .
Most low scores come from a drawing typed by hand that stopped matching the network. Draw the store standard from your NetBox data with the free tool, or read the free chapter first: PCI segmentation diagram .
What auditors check What an audit-ready network diagram includes: every security zone with a guarded edge and the device that enforces it; every connection to outside networks, wireless included; the VLANs and subnets in each zone; a flow register of what may cross each boundary, under default deny; and an owner, a date and the source it was drawn from. Score yours below: each question names the chapter that fixes it.
What the assessor checks: PCI DSS v4.0.1 requirement 1.2.3 asks for an accurate network diagram showing all connections between the cardholder data environment (CDE) and other networks, including any wireless networks. Requirement 1.2.4 asks for an accurate data-flow diagram of all account data flows, and if segmentation reduces scope, 11.4.5 asks for it to be penetration-tested at least once every 12 months and after changes. What is in scope is your QSA's call, made on your evidence (see the PCI SSC's scoping and segmentation guidance ).
Round 1. The readers 1. The operations director asks, "If the broadband goes down on a Saturday, can we still take cards?" Your drawing...CHAPTER 2, 7 (a) has an overview page that answers in plain words.(b) answers, but only for someone who reads VLAN tables for fun.(c) is not something you would show the operations director.2. Which readers does the drawing serve?CHAPTER 1 (a) Each reader has a page: an overview at the very least, plus a logical page and a physical page.(b) Everyone shares one crowded page.(c) Whoever drew it, and they've moved on.3. Look at the corner of each page. You find...CHAPTER 2, 13 (a) a filled title block on every page: store, date, revision.(b) the store name and a date from before the last refit.(c) a logo.4. The legend...CHAPTER 4 (a) covers every color, dash and icon on the drawing, and no page invents its own.(b) is there, though a few pages improvise.(c) is folklore.Round 2. Zones and addressing 5. Inside the store, your drawing shows...CHAPTER 3 (a) separate zones for the checkout (CDE), the back office, customer Wi-Fi, store devices and network management.(b) two boxes: "tills" and "everything else".(c) one box called STORE.6. Point at the CDE on your drawing. Its edge is...CHAPTER 3, 4 (a) a clear boundary, with every device inside it named and every way in or out passing a drawn firewall interface.(b) a box around the registers, with the PIN pads and POS server somewhere nearby.(c) not drawn, because "the tills are separate anyway".7. Choose a subnet anywhere in the store. You find it...CHAPTER 4 (a) once, in the table of the one zone it belongs to, with VLAN ID, name and gateway.(b) in a zone table, with the gateway column empty.(c) on the IP spreadsheet, which may or may not be the latest one.8. The store firewall is drawn...CHAPTER 4 (a) straddling the boundaries it enforces, every interface labeled with the zone on its side.(b) between the store and the internet, and nowhere else.(c) as a brick wall in the corner of the page.9. How are the VLANs named?CHAPTER 4, Appendix H (a) By a pattern someone wrote down, and none is without a zone.(b) Mostly by a pattern, apart from a couple left over from a pilot.(c) At least one is called TEST, NEW or the name of a store that closed.Round 3. The building 10. Walk to the counter and pick a register. The drawing shows...CHAPTER 5 (a) the register, its PIN pad, the counter switch and the port each uses, with labels that match the cables.(b) the registers, but not which port they use.(c) a single icon labeled POS.11. The link from the back office cabinet to the counter switch shows...CHAPTER 5 (a) exactly which VLANs it carries, and they're only the ones the counter needs.(b) "trunk".(c) a line.12. The cabinet in the back office (or the stockroom, or under the stairs) is drawn...CHAPTER 6 (a) as a cabinet: what's in it, at which height, and what powers it, including the UPS.(b) as a list of devices that live "in the back".(c) It isn't, but everyone knows where it is. Roughly.13. When the broadband line fails, your drawing shows...CHAPTER 7 (a) what moves to the backup line, what is switched off, and what the tills do if both lines fail.(b) that there is a backup line.(c) one line, to a cloud.14. On your drawing, the Wi-Fi appears as...CHAPTER 8 (a) access points placed on a floor plan, plus a table giving every SSID's VLAN and zone, with none landing in the CDE unless the drawing says so deliberately.(b) access points on a floor plan, and nothing about SSIDs.(c) a cloud labeled FREE WI-FI.Round 4. The conversations 15. The card's journey, from PIN pad to processor and from store to head office, is drawn...CHAPTER 9 (a) lane by lane, each arrow starting at whoever opens the conversation, with protocol and port.(b) as two-headed arrows with no ports.(c) It isn't drawn.16. Your assessor asks, "Can guest Wi-Fi reach the tills?" Your drawing...CHAPTER 9, 10 (a) shows the denied path explicitly: guest to CDE, store devices to CDE, back office to CDE, internet to the store.(b) draws the yeses and leaves the noes to the imagination.(c) Your answer starts with "I'm pretty sure".17. The flow register or zone matrix...CHAPTER 10, 16 (a) has an answer for every pair of zones, and someone has held it up against the firewall rules within the past six months.(b) is complete, and has never met the firewall.(c) is something you're hearing about for the first time.Round 5. Staying true 18. Where do the IPs, serials and VLAN tables on the page come from?CHAPTER 12 (a) A single source of record, such as NetBox, and are rebuilt from it.(b) A spreadsheet that gets updated when someone remembers.(c) Whatever was typed into the shape at handover.19. When was the drawing last checked against the store itself?CHAPTER 13, 15 (a) In the last 90 days, and what didn't match, or wasn't known, went on a dated gaps list.(b) Before the last remodel or the last holiday season.(c) Opening day.20. The POS vendor's support line asks for "a network diagram". You can send a version with the management IPs, serials and circuit IDs taken out...CHAPTER 14 (a) before the support call ends.(b) after an afternoon with the delete key.(c) only by sending the full file and trusting nobody zooms in.Your result Answer the questions above Your tier appears here as you go.
Share your tier, not your drawing.
Network Diagrams by Industry · Book 4
Draw Secure Retail Network Diagrams: From Point of Sale to PCI Segmentation
Every question names the chapter that fixes it, so every low score is a reading list.
The rest of the book: Cardholder data segmentation, POS, guest Wi-Fi and store IoT, from three stores to three hundred. One-time payment, 14-day refund.
Scorecards for other industries
Every book ends with a 20-question scorecard written for its own networks. Take any of them free.
Free quiz · Book 1, Appendix B
Score your plant network diagram Twenty questions written for manufacturing networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 2, Appendix B
Score your school network diagram Twenty questions written for education networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 3, Appendix B
Score your warehouse network diagram Twenty questions written for warehousing and logistics networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 5, Appendix B
Score your office network diagram Twenty questions written for offices networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 6, Appendix B
Score your bank network diagram Twenty questions written for banks and credit unions networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 7, Appendix B
Score your local government network diagram Twenty questions written for local government networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 8, Appendix B
Score your hotel network diagram Twenty questions written for hotels and hospitality networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 9, Appendix B
Score your corporate network diagram Twenty questions written for corporate hq and multi-site networks, 0 to 100, with a tier you can share.
Take the quiz → Free quiz · Book 10, Appendix B
Score your dealership network diagram Twenty questions written for car dealerships networks, 0 to 100, with a tier you can share.
Take the quiz →