What Requirement 11.4 covers
Requirement 11.4 breaks into sub-requirements. 11.4.1 requires a defined and documented penetration testing methodology. 11.4.2 covers internal penetration testing and 11.4.3 covers external penetration testing, both on at least a 12-month cycle and also after any significant infrastructure or application upgrade or change. Segmentation controls get their own cycle under 11.4.5, and service providers test segmentation more frequently under 11.4.6.
Read the requirement text yourself in the standard before you scope an engagement. The PCI Security Standards Council publishes PCI DSS in its document library, and your assessor will be working from that text rather than from anyone's summary of it, including this one.
The methodology requirement is the one people miss
11.4.1 is a documentation requirement, and it is the one that produces findings even when a test was performed. The methodology has to be defined and documented: it covers the full cardholder data environment perimeter, tests from both inside and outside the network, and includes network-layer and application-layer testing.
If your tester's report does not describe the methodology it followed, you have a test but not evidence that the methodology requirement is met. Ask for the methodology in the deliverable, not just the findings.
"After any significant change" is the stricter trigger
Twelve months is the floor, not the schedule. The second trigger, testing after any significant infrastructure or application upgrade or change, is what actually governs a team that ships regularly.
Whether a given release is a significant change is a judgment you have to make and document. A new payment page, a new third-party integration in the payment flow, or a change to how the environment is segmented will generally be. Write down the decision and the reasoning, because the absence of that record is itself the gap.
A vulnerability scan is not a penetration test
PCI DSS asks for both, in different sub-requirements, and they are not interchangeable. Quarterly scanning and annual penetration testing are separate obligations.
An ASV scan satisfies the external scanning requirement; it does not satisfy 11.4. If a vendor offers to meet your penetration testing requirement with a scan report, that is a vendor to decline.
Scoping a PCI penetration test
The scope is the cardholder data environment and anything that can reach it. Segmentation is what keeps that scope small, which is why 11.4.5 exists: if segmentation does not hold, everything behind it is in scope.
CyberArc tests networks and applications under written authorization, which covers the surfaces 11.4.2 and 11.4.3 address. Bring your current scope definition and your assessor's expectations to the scoping call so the written scope matches what will be assessed.