Which two actions must merchants do to be compliant with the Payment Card Industry Data...

B (Install firewalls):PCI DSS requires network segmentation, filtering, and perimeter defense via firewalls.

C (Use antivirus software):Malware protection and anti-virus software are mandatory on all systems interacting with cardholder data.

Other options explained:

A/D/E: These are general security best practices but not specific mandatory requirements under PCI DSS control objectives.