A compliance-based penetration test is primarily concerned with:

While a compliance test might involve attempting to access PII, its primary concern is not the acquisition of PII itself, but rather assessing whether the controls protecting such data comply with relevant standards.

Bypassing protections on edge devices is a potential technique within a penetration test, but it is not the overarching primary concern of a compliance-based test, which focuses on adherence to standards across the scope.

A compliance-based penetration test is fundamentally designed to evaluate whether an organization's security posture and implemented controls effectively meet the requirements of specific regulatory, industry, or internal security standards and policies.

Obtaining specific information from the protected network is a common objective for many penetration tests, but for a compliance-based test, this is done to verify that data protection controls mandated by compliance standards are effective, not as the standalone primary goal.