External vulnerability scans must be performed by what type of vendor, approved by which body, and what about rescans?

External vulnerability scans must be performed by what type of vendor, approved by which body, and what about rescans?

• A. External vulnerability scans must be performed by an Approved Scanning Vendor (ASV) approved by the PCI SSC, with rescans performed as needed until passing scans are achieved.
• B. External scans must be performed by internal staff.
• C. External scans are optional.
• D. External scans are performed only once per year.

Answer: (A)

External vulnerability scans for PCI DSS must be performed by an Approved Scanning Vendor (ASV) that is approved by the PCI Security Standards Council (PCI SSC). This ensures the scans are conducted with a standardized, independent approach that PCI SSC recognizes for validating external security of the cardholder data environment. After any vulnerabilities are found and remediated, rescans are required to verify that those issues have been addressed and to confirm the environment now passes the scan. You continue rescanning as needed until the result shows a passing status, rather than accepting a partial fix or skipping remediation. Putting it in context helps: relying on internal staff for these external scans would not meet the PCI SSC-approved requirement, and the scans are not optional or a one-time yearly check. In practice, external scans are performed at least quarterly and after significant changes, with rescans ensuring ongoing compliance and remediation validation.

External vulnerability scans for PCI DSS must be performed by an Approved Scanning Vendor (ASV) that is approved by the PCI Security Standards Council (PCI SSC). This ensures the scans are conducted with a standardized, independent approach that PCI SSC recognizes for validating external security of the cardholder data environment. After any vulnerabilities are found and remediated, rescans are required to verify that those issues have been addressed and to confirm the environment now passes the scan. You continue rescanning as needed until the result shows a passing status, rather than accepting a partial fix or skipping remediation.

Putting it in context helps: relying on internal staff for these external scans would not meet the PCI SSC-approved requirement, and the scans are not optional or a one-time yearly check. In practice, external scans are performed at least quarterly and after significant changes, with rescans ensuring ongoing compliance and remediation validation.