A security assessment method that uses active tools to simulate an attack, verify existence of threats, bypass controls, and exploit vulnerabilities is called what?

A security assessment method that uses active tools to simulate an attack, verify existence of threats, bypass controls, and exploit vulnerabilities is called what?

• A. Vulnerability scanning
• B. Penetration testing
• C. Red team exercise
• D. Security audit

Answer: (B)

Penetration testing is the practice of using active tools to simulate real-world attacks, verify the existence of threats, bypass defenses, and exploit vulnerabilities in a controlled environment. This exactly matches the scenario described, where the approach goes beyond merely scanning for weaknesses and actually attempts to break in to see what could be exploited and what impact it would have. Vulnerability scanning, by contrast, mainly identifies potential weaknesses without attempting exploitation. A red team exercise is broader and longer-term, simulating a full attacker campaign across multiple objectives, not just a focused, controlled exploit test. A security audit evaluates policies, controls, and compliance rather than actively exploiting systems.

Penetration testing is the practice of using active tools to simulate real-world attacks, verify the existence of threats, bypass defenses, and exploit vulnerabilities in a controlled environment. This exactly matches the scenario described, where the approach goes beyond merely scanning for weaknesses and actually attempts to break in to see what could be exploited and what impact it would have.

Vulnerability scanning, by contrast, mainly identifies potential weaknesses without attempting exploitation. A red team exercise is broader and longer-term, simulating a full attacker campaign across multiple objectives, not just a focused, controlled exploit test. A security audit evaluates policies, controls, and compliance rather than actively exploiting systems.