During the most recent 12 months, how many internal vulnerability scans must be performed?

• A. Three
• B. Four
• C. Five
• D. Six

Answer: (B)

Internal vulnerability scans must be performed at least quarterly. That means four scans in any 12-month period to regularly check the cardholder data environment for new or evolving weaknesses and to remediate them promptly. The minimum remains four per year, even if no changes occur. You would only have more than four if there were significant changes or you chose to run additional scans for extra assurance. So, for the most recent 12 months, the minimum number required is four, making four the correct answer. Three is not enough to meet the quarterly requirement, while five or six would indicate more than the minimum due to extra scans, not the base rule.