After a significant change, which is required regarding scans?

After a significant change, which is required regarding scans?

• A. Only the most recent scan is needed.
• B. Internal and external scans, and rescans as needed, must be performed by qualified personnel.
• C. Scans are unnecessary if changes are minor.
• D. External scans alone suffice.

Answer: (B)

After a significant change, vulnerability scans must cover both the internal and external environments, and any needed rescans should be performed by qualified personnel. Running internal scans checks for weaknesses inside the network that outsiders can’t reach directly, while external scans look at the perimeter to find issues that could be exploited from outside. Re-scanning as needed ensures that fixes have been properly applied and that the change didn’t introduce new vulnerabilities. This comprehensive approach is necessary because relying on only one type of scan or skipping rescans could miss gaps or newly created risks.

After a significant change, vulnerability scans must cover both the internal and external environments, and any needed rescans should be performed by qualified personnel. Running internal scans checks for weaknesses inside the network that outsiders can’t reach directly, while external scans look at the perimeter to find issues that could be exploited from outside. Re-scanning as needed ensures that fixes have been properly applied and that the change didn’t introduce new vulnerabilities. This comprehensive approach is necessary because relying on only one type of scan or skipping rescans could miss gaps or newly created risks.