This is an excellent review and well worth the read.  Much confusion exists for those navigating the PCI DSS, and many truly do not understand the difference between a vulnerability scan and a penetration test.

https://www.tripwire.com/state-of-security/regulatory-compliance/pci/5-things-know-pci-dss-penetration-testing/