An organization must comply with a new regulation that requires the organization to determine if an external attacker is able to gain access to its systems from outside the network. Which of the…

A compliance review evaluates whether existing controls align with policy or regulatory requirements on paper but does not actively test whether an attacker could actually breach the systems.

A vulnerability assessment identifies and catalogues weaknesses but stops short of active exploitation, so it cannot confirm whether an external attacker would successfully gain access through those weaknesses.

A black box penetration test replicates the exact scenario described by the regulation - an external attacker with no insider knowledge attempting to gain access - by actively exploiting vulnerabilities, which directly confirms or denies whether the organization's perimeter defenses can be breached from outside.

A full system audit examines system configurations and controls for accuracy and alignment with policy but does not simulate real-world external attack scenarios or validate exploitability.