PCI Data Security Standard Practice Test

Penetration testing must review threats and vulnerabilities experienced in the last 12 months.

Not Required Last Quarter Last 5 Years Last 12 Months

Correct Answer:

Last 12 Months

Explanation:

Penetration testing needs to reflect the current threat landscape and the vulnerabilities that could realistically affect the environment. Reviewing threats and vulnerabilities experienced in the last 12 months keeps the test aligned with recent attacker techniques, newly disclosed CVEs, and changes in the environment, so the scenarios and exploited weaknesses are relevant to today’s risk level. Choosing a window like last quarter would miss many recent developments, while a window of several years includes outdated issues that may no longer be actionable or present. A window of the last 12 months strikes the right balance, ensuring the test evaluates controls against recent and realistic risks.

Access more questions from this quiz

Continue to PCI Data Security Standard Practice Test for more practice questions and the full quiz experience.

Access More Questions