Exploitable vulnerabilities found during penetration testing are corrected and testing is repeated to verify the corrections.

Exploitable vulnerabilities found during penetration testing are corrected and testing is repeated to verify the corrections.

• A. Correction Not Required
• B. Testing After Correction Only
• C. Retest Optional
• D. Corrections Must Be Made And Retested

Answer: (D)

When vulnerabilities are found, fixes must be applied and the testing repeated to confirm those fixes actually worked. This re-testing step validates that the exploitable issue is truly resolved and that the remediation didn’t introduce new problems. In PCI DSS testing, remediation plus retesting is the standard approach to ensure risk is properly reduced before concluding the assessment. So, the phrase that captures this process—making corrections and then retesting to verify them—is the correct one. Not correcting would leave risk unaddressed, testing only after correction without rechecking would miss lingering or new issues, and treating retesting as optional would weaken the verification needed to trust the results.

When vulnerabilities are found, fixes must be applied and the testing repeated to confirm those fixes actually worked. This re-testing step validates that the exploitable issue is truly resolved and that the remediation didn’t introduce new problems. In PCI DSS testing, remediation plus retesting is the standard approach to ensure risk is properly reduced before concluding the assessment. So, the phrase that captures this process—making corrections and then retesting to verify them—is the correct one. Not correcting would leave risk unaddressed, testing only after correction without rechecking would miss lingering or new issues, and treating retesting as optional would weaken the verification needed to trust the results.