An ASV must scan everything in the external scope.

An ASV must scan everything in the external scope.

• A. Not necessarily
• B. True
• C. Only for critical components
• D. Only for high-risk assets

Answer: (B)

The main idea here is that vulnerability scans performed by an ASV must cover the entire external surface that could be reachable from the internet and are in scope for the cardholder data environment. That means every asset identified as being part of the external scope—every internet-facing IP, domain, and related component that touches the CDE—must be scanned. The reason is simple: any exposed asset, not just the ones deemed “critical” or high-risk, can be exploited by attackers. Comprehensive coverage helps ensure that no external entry point slips through the cracks. So the statement is true because external ASV scans are required to encompass all external-scope assets, rather than a subset of them.

The main idea here is that vulnerability scans performed by an ASV must cover the entire external surface that could be reachable from the internet and are in scope for the cardholder data environment. That means every asset identified as being part of the external scope—every internet-facing IP, domain, and related component that touches the CDE—must be scanned. The reason is simple: any exposed asset, not just the ones deemed “critical” or high-risk, can be exploited by attackers. Comprehensive coverage helps ensure that no external entry point slips through the cracks.

So the statement is true because external ASV scans are required to encompass all external-scope assets, rather than a subset of them.