Which of the following is a characteristic of convert security testing?

Inducing less risk than over-testing is not a characteristic of covert testing; in fact, covert tests can introduce operational risk because response teams may react to simulated attacks as if they were real incidents.

Covert testing is specifically designed to be conducted without the awareness of the target staff, which means it authentically evaluates whether employees recognize threats and respond according to the organization's security policy. Because staff are unaware a test is occurring, their reactions reflect genuine compliance with-or deviation from-established security procedures, making policy knowledge and implementation the primary characteristic being assessed.

Focusing on identifying vulnerabilities is characteristic of penetration testing or vulnerability assessments, not specifically covert (blind) security testing, which centers on human and procedural responses rather than technical flaw discovery.

Testing and validating all security controls describes a comprehensive security audit or full-scope assessment, not covert testing, which is scoped to evaluate staff awareness and behavioral responses without their knowledge.