CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Monthly internal vulnerability scans

  Why it's wrong here

  While internal vulnerability scans are a crucial PCI DSS requirement (Requirement 11.2.1), the standard mandates them at least quarterly, not monthly. Performing them monthly exceeds the minimum requirement but is not the specific frequency mandated for a PCI DSS assessment, making this option incorrect as a required preparation step if interpreted as the minimum frequency. The key is the quarterly cadence.

• ✗

  SOC 2 Type II report

  Why it's wrong here

  A SOC 2 Type II report, while demonstrating a service organization's controls over security, availability, processing integrity, confidentiality, or privacy, is not a direct requirement for a company preparing for a PCI DSS assessment. PCI DSS has its own specific set of compliance requirements and validation procedures, which are distinct from the AICPA's Trust Services Criteria addressed by SOC 2 reports. One does not substitute for or directly fulfill the other's assessment criteria.

• ✗

  Annual penetration test of all systems

  Why it's wrong here

  PCI DSS Requirement 11.3 mandates annual penetration testing, but specifically within the scope of the Cardholder Data Environment (CDE) and any systems that could impact its security. The phrase "all systems" is overly broad and inaccurate for PCI DSS compliance, as it would include systems entirely outside the CDE and its connected components, leading to unnecessary effort and misinterpreting the standard's scope. The focus must remain on the CDE and critical systems connected to it.

• ✓

  Annual on-site assessment by a QSA

  Why this is correct

  For Level 1 merchants and service providers, an annual on-site assessment by a Qualified Security Assessor (QSA) is a mandatory component of PCI DSS compliance validation. The QSA conducts a thorough review of the organization's Cardholder Data Environment (CDE), policies, procedures, and technical controls to ensure adherence to all applicable PCI DSS requirements, culminating in a Report on Compliance (ROC). This external validation is a cornerstone of the standard's assurance model.

• ✓

  Quarterly external vulnerability scans by an ASV

  Why this is correct

  PCI DSS Requirement 11.2.2 specifically mandates that organizations perform quarterly external vulnerability scans by an Approved Scanning Vendor (ASV). These scans are critical for identifying external vulnerabilities in network components and applications that could be exploited by attackers, ensuring that the organization's public-facing infrastructure remains secure against common threats. The ASV's role is to provide an independent, qualified assessment of external network security.

Go deeper

Related to this question