External vulnerability scans must be performed by which entity?

• A. Internal security team
• B. PCI SSC Approved Scanning Vendor
• C. Third-party not ASV
• D. The system administrator

Answer: (B)

External vulnerability scans are a formal requirement for PCI DSS to verify exposure of systems that can be reached from the internet, and they must be conducted by a PCI SSC Approved Scanning Vendor. This approval ensures the scanning is performed using standardized methods, with consistent reporting and validation procedures that align with PCI standards. The goal is to have an independent, credible assessment from a vendor specifically vetted by PCI SSC, providing evidence that external weaknesses are identified and can be remediated before attackers can exploit them. While internal teams or system administrators can conduct internal vulnerability tests or scans of internal networks, they do not satisfy the official requirement for external scanning because only ASVs are authorized to perform and report the quarterly external scans for PCI validation. A third party that is not an ASV cannot supply the compliant external scan report needed for PCI DSS evidence.