Penetration testing scope must cover which of the following?

Penetration testing scope must cover which of the following?

• A. Only Internal Network
• B. Endpoints
• C. Entire CDE Perimeter and Critical Systems
• D. Only External Network

Answer: (C)

The scope of a penetration test must be comprehensive across the cardholder data environment, including the entire CDE perimeter and the critical systems that support or connect to it. The idea is to simulate attacker paths that could lead to cardholder data, not just test isolated parts. If you test only the internal network, you miss external exposure; if you test only endpoints, you miss how attackers can pivot through the network to reach CHD; testing only the external network ignores what happens once access is gained or how internal systems are protected. By covering the full CDE perimeter and the critical systems, the assessment validates that controls—like segmentation, access controls, and firewall rules—hold up against realistic attack methods and that no single weak link can bridge into CHD.

The scope of a penetration test must be comprehensive across the cardholder data environment, including the entire CDE perimeter and the critical systems that support or connect to it. The idea is to simulate attacker paths that could lead to cardholder data, not just test isolated parts. If you test only the internal network, you miss external exposure; if you test only endpoints, you miss how attackers can pivot through the network to reach CHD; testing only the external network ignores what happens once access is gained or how internal systems are protected. By covering the full CDE perimeter and the critical systems, the assessment validates that controls—like segmentation, access controls, and firewall rules—hold up against realistic attack methods and that no single weak link can bridge into CHD.