The penetration testing methodology must include which of the following?

• A. Is based on industry-accepted penetration testing approaches
• B. Includes testing from inside and outside the network
• C. Specifies retention of testing results and remediation activities
• D. Includes coverage for the entire CDE perimeter and critical systems

Answer: (D)

The key idea is ensuring the penetration testing scope truly encompasses all areas that could affect cardholder data. By covering the entire Cardholder Data Environment perimeter and the critical systems, you verify that every relevant surface—from external boundaries to core systems that store, process, or transmit PAN—is evaluated. This comprehensive scope prevents hidden gaps where vulnerabilities could slip through, which is essential for accurately assessing risk and guiding effective remediation. While using an industry-accepted testing approach, testing from inside and outside, and documenting results and remediation are important, they don’t by themselves guarantee that all critical assets and pathways are tested. Focusing on complete coverage of the CDE perimeter and critical systems ensures the testing aligns with the goal of protecting cardholder data across the environment.