After passive tests indicate the configuration appears correct, what is the likely next step to identify vulnerabilities and potential compromises?

• A. Vulnerability assessment
• B. Security audit
• C. Compliance review
• D. Penetration testing

Answer: (D)

Active validation of security through controlled exploitation is the next step. Penetration testing involves simulating attacker techniques to attempt to breach defenses, escalate privileges, or access sensitive data in a safe, authorized way. This goes beyond passive checks by confirming whether known or unknown vulnerabilities can actually be exploited in the real environment, helping to gauge risk and prioritize fixes. A vulnerability assessment identifies weaknesses but does not prove they are exploitable. Security audits and compliance reviews examine policy adherence and controls, not the practical ability to compromise systems. So after configuration appears correct from passive tests, penetration testing is the appropriate next step to identify vulnerabilities that could lead to compromise.