Which of the following is true regarding internal vulnerability scans?

Which of the following is true regarding internal vulnerability scans?
A . They must be performed after a significant change
B . They must be performed by an Approved Scanning Vendor (ASV)
C . They must be performed by QSA personnel
D . They must be performed at least annually

View Answer

Answer: A

Explanation:

According to the PCI DSS v3.2.1 Quick Reference Guide1, internal vulnerability scans must be performed after a significant change in any component or configuration that affects cardholder data or payment processing systems. This is one of the requirements for identifying and mitigating vulnerabilities that could compromise cardholder data.