An organization must comply with a new regulation that requires the organization to determine if an external attacker is able to gain access to its systems from outside the network. Which of the…

A compliance review verifies whether documented policies and controls are in place but does not involve actually testing whether an attacker can breach the systems.

A vulnerability assessment identifies and catalogues potential weaknesses but stops short of exploiting them, so it cannot confirm whether external access is achievable.

A black box penetration test places the tester in the exact position of an external attacker - with no internal knowledge, credentials, or network access - and attempts to actively exploit vulnerabilities to gain access to systems. This directly satisfies the regulation's requirement to determine if an external attacker can gain access, because the test replicates that threat scenario and produces evidence of whether access was achieved. Unlike assessments that only identify weaknesses, a penetration test confirms exploitability.

A full system audit reviews configurations, logs, and processes for adherence to standards but does not simulate an external attack or test for exploitability from outside the network.