Which frequency is required for external vulnerability scans?

• A. Quarterly.
• B. Monthly.
• C. Semiannually.
• D. Annually.

Answer: (A)

External vulnerability scans must be done at least every quarter by an Approved Scanning Vendor. This quarterly cadence ensures that publicly exposed systems are regularly checked for newly discovered vulnerabilities, keeping the assessment current without requiring monthly scans. Performing scans more often than quarterly isn’t the standard minimum, while semiannual or annual frequencies would leave longer gaps where vulnerabilities could go undetected. Additionally, after any significant change to the network, a re-scan is required to verify that new changes haven’t introduced unaddressed weaknesses.