mediumMultiple Select
CS0-003 Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for vulnerability scanning in a PCI DSS compliant environment? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform quarterly scans
Options A and E are correct. PCI DSS Requirement 11.2.1 mandates quarterly internal and external vulnerability scans, so option A is correct. Option E is correct because authenticated scanning provides more accurate results by identifying vulnerabilities visible only to authenticated users. Option B is incorrect because PCI DSS requires scanning both external and internal IP ranges, not just external. Option C is incorrect because PCI DSS does not require a single scanning vendor; organizations may use multiple vendors. Option D is incorrect because while scanning after significant network changes is a best practice, it is not a specific PCI DSS requirement in this context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform quarterly scans
Why this is correct
PCI DSS requirement 11.2 mandates quarterly external and internal scans.
- ✗
Scan only external IP ranges
Why it's wrong here
PCI DSS requires scanning both internal and external IP addresses.
- ✗
Use a single scanning vendor
Why it's wrong here
Using multiple vendors can provide broader coverage and validation.
- ✗
Scan after any significant network change
Why it's wrong here
While recommended, it is not one of the two best practices listed here; the focus is quarterly scanning.
- ✓
Use authenticated scanning for more accurate results
Why this is correct
Authenticated scans provide deeper visibility and are recommended as best practice.
Go deeper
Related to this question
Learn chapter
Vulnerability Management Workflow
Key term
Vulnerability scanning
Vulnerability scanning is an automated process that identifies security weaknesses in systems, networks, and applications by comparing them against known vulnerability databases.
Key term
Payment Card Industry Data Security Standards
A set of security rules that any company that handles credit card payments must follow to protect cardholder data from theft and fraud.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.