Which of the following would provide the MOST reliable evidence of the effectiveness of security controls implemented for a web application?

Penetration testing actively simulates real-world attacks by ethical hackers to exploit vulnerabilities and attempt to bypass security controls. This method provides concrete, actionable evidence of whether controls are effective in preventing unauthorized access or data breaches in a live environment.

An IT general controls audit assesses foundational controls across an IT environment but isn't specifically focused on the technical effectiveness of controls within a web application against attack.

A vulnerability assessment identifies potential weaknesses but does not actively test if they can be exploited or if existing controls can prevent exploitation.

Fault tree analysis is a top-down, deductive failure analysis that graphically represents the various combinations of hardware, software, and human failures that could result in a specified undesired event, which is less about practical control effectiveness.