External penetration testing must be performed at least how often and by whom?

External penetration testing must be performed at least how often and by whom?

• A. Biannually by a QSA
• B. Monthly by the network administrator
• C. Annually by a qualified internal resource or qualified external third party
• D. Quarterly by the security team

Answer: (C)

External penetration testing is meant to verify defenses against real outside attackers and should be done on a regular cadence plus whenever the environment changes in a way that could affect security. The minimum is once a year, and after any significant changes to the network or cardholder data environment. The tester must be qualified, which can be an internal resource with the right expertise or an external third party that is qualified. This combination ensures the assessment is credible and actionable, with findings that reflect current risk and changes that were made. While a test conducted by a QSA is possible, the standard does not require only QSAs; internal staff who are qualified can conduct the test as well. That broader, annual, and qualified-tester requirement is why this option is the best fit.

External penetration testing is meant to verify defenses against real outside attackers and should be done on a regular cadence plus whenever the environment changes in a way that could affect security. The minimum is once a year, and after any significant changes to the network or cardholder data environment. The tester must be qualified, which can be an internal resource with the right expertise or an external third party that is qualified. This combination ensures the assessment is credible and actionable, with findings that reflect current risk and changes that were made. While a test conducted by a QSA is possible, the standard does not require only QSAs; internal staff who are qualified can conduct the test as well. That broader, annual, and qualified-tester requirement is why this option is the best fit.