Vulnerability Management Flashcards

What is the role of threat intelligence in a PCI DSS-aligned vulnerability management program?

Answer: It provides context about active exploits to help prioritize remediation

Threat intelligence identifies which vulnerabilities are being actively exploited, helping organizations prioritize remediation of the most dangerous flaws first.

Under PCI DSS, what happens to the ASV scan requirement if a merchant acquires a new external IP address range mid-quarter?

Answer: The new range must be included in an out-of-cycle scan before it processes card data

Any new external-facing infrastructure that enters the CDE scope must be scanned before it can be used to process card data, regardless of quarterly scheduling.

Which of the following describes a penetration test methodology that is consistent with PCI DSS Requirement 11.4?

Answer: Industry-accepted approach covering network and application layers with exploitation attempts

PCI DSS requires penetration tests to follow an industry-accepted methodology covering both network and application layers with actual exploitation attempts.

A penetration tester successfully pivots from a non-CDE system into the cardholder data environment. What does this finding indicate about the organization's controls?

Answer: Segmentation controls have failed and must be reviewed and remediated

A successful pivot into the CDE demonstrates that network segmentation has failed, requiring immediate remediation to restore isolation of cardholder data.

What is the minimum frequency for penetration testing of the CDE per PCI DSS Requirement 11.4?

Answer: Annually and after significant infrastructure or application changes

PCI DSS requires penetration testing at least annually and after any significant changes to the CDE network or applications.

How should vulnerability management findings be communicated to management under a PCI DSS-compliant program?

Answer: Findings must be reported to executive management with risk rankings and remediation timelines

PCI DSS expects that vulnerability findings, including risk rankings and remediation status, are communicated to appropriate management to ensure accountability.

Which of the following scenarios requires an immediate out-of-cycle vulnerability scan under PCI DSS?

Answer: A new server is added to the cardholder data environment

Adding a new server to the CDE constitutes a significant infrastructure change, triggering a requirement for an internal vulnerability scan after the change.