Which option lists the correct PCI DSS requirement concerns ASVs performing external vulnerability scans?

Which option lists the correct PCI DSS requirement concerns ASVs performing external vulnerability scans?

• A. Requirement 10.5
• B. Requirement 11.5
• C. Requirement 9.9
• D. Requirement 11.2

Answer: (D)

The key idea is that external vulnerability scans must be done by an Approved Scanning Vendor (ASV) on a regular basis, specifically quarterly, to identify publicly reachable weaknesses in the cardholder data environment. PCI DSS relies on the objectivity and standardization that an ASV provides, ensuring scans are conducted consistently and that remediation can be verified. The correct option reflects this requirement by focusing on external scans performed by an ASV and on a quarterly schedule (with remediation steps and re-testing as needed). The other choices relate to different PCI DSS areas—such as log review or physical security—not to who performs external vulnerability scans.

The key idea is that external vulnerability scans must be done by an Approved Scanning Vendor (ASV) on a regular basis, specifically quarterly, to identify publicly reachable weaknesses in the cardholder data environment. PCI DSS relies on the objectivity and standardization that an ASV provides, ensuring scans are conducted consistently and that remediation can be verified. The correct option reflects this requirement by focusing on external scans performed by an ASV and on a quarterly schedule (with remediation steps and re-testing as needed). The other choices relate to different PCI DSS areas—such as log review or physical security—not to who performs external vulnerability scans.