According to requirement 11.2, vulnerability scans conducted after changes should be performed only by an ASV.

• A. TRUE
• B. FALSE
• C. Only internal staff
• D. Only on demand

Answer: (B)

Scanning after significant changes is required to confirm that the changes haven’t introduced new vulnerabilities. However, who performs that scan is not restricted to an Approved Scanning Vendor. Internal teams can run vulnerability scans after changes using internal tools, while the external-scanning requirement—performed quarterly—must be done by an ASV. The statement that these post-change scans must be done only by an ASV is therefore incorrect, because internal personnel can also carry out the post-change scans to validate the environment before moving changes into production.