Which statement about exemptions for scanning systems is true?

• A. The systems are directly connected to systems in the cardholder data environment
• B. The systems are located in the same DMZ as systems in the cardholder data environment
• C. The systems are located in the same network as systems in the cardholder data environment
• D. The systems are properly segmented from the cardholder data environment

Answer: (D)

Exemptions for scanning systems hinge on network segmentation. If the systems used for vulnerability scanning are properly segmented from the cardholder data environment, they sit outside the CDE’s boundaries and typically aren’t bound by the same external scanning requirements. This separation is achieved with clear network boundaries, controlled traffic, and barriers (like firewalls) that prevent direct access to cardholder data from the scanning system.

That’s why this statement is the best: it describes a setup where the scanner lives in a separate network segment, isolated from the CDE, which makes it eligible for exemption. If the scanner were directly connected to the CDE, or placed in the same DMZ or the same network as the CDE, there would be a direct or potential path to the cardholder data, meaning it remains in scope and would require scanning.