Which term represents the organization approved by the PCI SSC to perform external vulnerability scanning?

Which term represents the organization approved by the PCI SSC to perform external vulnerability scanning?

• A. Automated Scanning Validator
• B. Approved Scanning Vendor
• C. Accredited Security Validator
• D. Application Scanning Vendor

Answer: (B)

External vulnerability scanning must be performed by an Approved Scanning Vendor (ASV) approved by the PCI SSC. The PCI Security Standards Council maintains a list of ASVs specifically authorized to conduct quarterly external vulnerability scans of networks and systems reachable from the internet. This official designation ensures the scans follow standardized methods and produce credible results used for PCI DSS validation by merchants and their acquirers. The other terms listed aren’t the recognized PCI SSC designation for this purpose, so they don’t reflect the official process or standard.

External vulnerability scanning must be performed by an Approved Scanning Vendor (ASV) approved by the PCI SSC. The PCI Security Standards Council maintains a list of ASVs specifically authorized to conduct quarterly external vulnerability scans of networks and systems reachable from the internet. This official designation ensures the scans follow standardized methods and produce credible results used for PCI DSS validation by merchants and their acquirers. The other terms listed aren’t the recognized PCI SSC designation for this purpose, so they don’t reflect the official process or standard.