External penetration testing must be performed at least annually and after any significant upgrades or modifications.

External penetration testing must be performed at least annually and after any significant upgrades or modifications.

• A. Monthly
• B. Never
• C. Only After Upgrades
• D. Annually And After Upgrades

Answer: (D)

Regular external testing is used to verify that attack paths exposed by the public internet haven’t changed or opened up due to updates or network edits. It’s performed at least once a year to establish a baseline risk level and again after any significant upgrades or modifications to the environment to catch new weaknesses those changes might introduce. That’s why the best choice is the one that requires both annual testing and testing after changes. Monthly testing is excessive for a formal penetration test, never is incorrect because you always need at least a yearly check, and testing only after upgrades misses the mandatory annual assessment.

Regular external testing is used to verify that attack paths exposed by the public internet haven’t changed or opened up due to updates or network edits. It’s performed at least once a year to establish a baseline risk level and again after any significant upgrades or modifications to the environment to catch new weaknesses those changes might introduce. That’s why the best choice is the one that requires both annual testing and testing after changes. Monthly testing is excessive for a formal penetration test, never is incorrect because you always need at least a yearly check, and testing only after upgrades misses the mandatory annual assessment.