PCI SSCPCI DSSVulnerability ManagementEASYFree question
What is the purpose of vulnerability scanning in PCI DSS compliance?
- A.To record the open ports on CDE hosts and document that unused services were removed as the standard requires
- B.To simulate an attacker exploiting weaknesses in the CDE and demonstrate real compromise so the results can drive segmentation changes
- C.To identify known security vulnerabilities in systems and applications so they can be remediated before exploitation
- D.To verify that cardholder data is encrypted on disk and in transit so the assessor can confirm the cryptography requirements are met
Why C is correct
Vulnerability scanning systematically identifies known security weaknesses in systems, networks, and applications, enabling organizations to remediate them before attackers can exploit them.
Know someone studying for PCI DSS? Send them this one.