Which item is not listed as a Special Note?

• A. When POS software is detected
• B. When remote access software is detected
• C. When directory browsing on a web server is detected
• D. When antivirus software is detected

Answer: (D)

Special Notes in an ASV scan are flags for conditions that need human review or fall outside the standard automated checks, often related to risky configurations or software that could indicate non-compliance. Examples like POS software being detected, remote access software being detected, or directory listing enabled on a web server signal scenarios that require careful interpretation and remediation planning. These are situations where the scan report prompts you to verify that the environment meets PCI DSS requirements.

Antivirus software detection, however, is a baseline security control—having antivirus installed and up to date is a standard expectation under PCI DSS. It isn’t a conditional or unusual finding that requires the special note type of review; if antivirus is present, there’s typically no special note triggered. If antivirus is missing or out of date, that would be addressed as a separate vulnerability finding rather than a Special Note.