Which term describes a live test of the effectiveness of security defenses by mimicking the actions of real-life attackers?

Which term describes a live test of the effectiveness of security defenses by mimicking the actions of real-life attackers?

• A. Lag risk indicator
• B. Penetration test
• C. Lead risk indicator
• D. Risk gap

Answer: (B)

A penetration test is a live examination where authorized testers simulate real-world attacker behavior to test how well security controls stand up to actual breach attempts. By attempting to exploit weaknesses, escalate privileges, and access sensitive data in a controlled setting, this type of testing reveals how effective defenses are in practice and whether detection and response processes work as intended. It goes beyond mere vulnerability scanning by proving what an attacker could achieve in the real world, helping prioritize fixes and validate security improvements. The other terms describe metrics or indicators rather than the active, attacker-simulated testing itself, so they don’t capture the practical assessment of defenses that a penetration test provides.

A penetration test is a live examination where authorized testers simulate real-world attacker behavior to test how well security controls stand up to actual breach attempts. By attempting to exploit weaknesses, escalate privileges, and access sensitive data in a controlled setting, this type of testing reveals how effective defenses are in practice and whether detection and response processes work as intended. It goes beyond mere vulnerability scanning by proving what an attacker could achieve in the real world, helping prioritize fixes and validate security improvements. The other terms describe metrics or indicators rather than the active, attacker-simulated testing itself, so they don’t capture the practical assessment of defenses that a penetration test provides.