True or False: The scan customer must provide a list of all IPs in a scope for the scan.

• A. TRUE
• B. FALSE
• C. Only Internet-facing IPs are required
• D. A subset of IP addresses may be provided

Answer: (B)

Defining scope for an external vulnerability scan centers on all assets that have external exposure and are in the cardholder data environment. You don’t have to hand over an exhaustive, line-by-line list of every IP address. Instead, you can define the scope using domains or CIDR blocks, and the ASV will identify and scan all live IPs that fall within that scope. If new assets appear or the scope changes, you update the scope and re-scan to maintain coverage. Providing only a subset of IPs would risk missing in-scope assets, and simply listing Internet-facing IPs does not guarantee that all in-scope external assets are scanned.