Which of the following assessments would Pete, the security administrator, use to actively test that an application's security controls are in place?

A code review is a static, passive examination of source code for defects and does not involve active testing of runtime security controls.

A penetration test goes beyond identifying potential weaknesses by actively attempting exploitation, which proves whether controls such as input validation, authentication, and access controls actually prevent attacks. This active, adversarial approach is what distinguishes it as the correct method to verify that controls are 'in place' and effective rather than merely present in configuration.

A protocol analyzer passively captures and inspects network traffic; it does not test or interact with application security controls.

A vulnerability scan identifies and enumerates potential weaknesses using automated probes but does not actively exploit them to confirm whether controls prevent an actual attack.