Which of the following is a true statement?

PCI DSS $($Payment Card Industry Data Security Standard$)$ does not require penetration test to be conducted on the networks that support business operations.

PCI DSS allows cardholder data records to be stored on an application server.

PCIDSS requires card holder data records to be stored in a remote data server which is also known as a data center.

All of the above.