PCI DSS v4.0 posture in SCC flags a Compute Engine VM in the CDE with an external IP. Immediate remediation?

• A. Enforce constraints/compute.vmExternalIpAccess at the project level.
• B. Remove the external IP from the VM's network interface settings.
• C. Remove the CDE tag to exclude from posture.
• D. Mark SHA PUBLIC_IP_ADDRESS finding as fixed.

Answer: (B)

When a resource in the cardholder data environment has a public endpoint, it increases the exposure risk that PCI DSS aims to minimize. The quickest and most effective remediation is to remove the external IP from the VM’s network interface, so the instance no longer has a public address and cannot be reached from the internet. This directly reduces exposure and brings the VM into alignment with PCI DSS expectations for the CDE.

Enforcing a project-level constraint to block external IPs helps prevent future instances from getting public IPs, but it doesn’t fix the current exposed VM. Removing the CDE tag would bypass the posture check rather than address the underlying risk, and marking the finding as fixed doesn't actually remediate the asset.