Which of the following tests a number of security controls in the least invasive manner?

A vulnerability scan uses automated tools to probe systems and compare configurations, patch levels, and open services against databases of known vulnerabilities. It does not exploit the vulnerabilities it finds, making it non-destructive and minimally disruptive. Because it passively identifies weaknesses rather than actively attacking them, it is considered the least invasive way to assess the posture of a large number of security controls simultaneously.

A threat assessment is a process of identifying and evaluating potential threats to an organization - it is a planning and analysis activity rather than an active technical test of implemented security controls.

A penetration test goes beyond scanning by actively exploiting discovered vulnerabilities to demonstrate real-world impact, making it significantly more invasive and potentially disruptive than a vulnerability scan.

A ping sweep is a simple network reconnaissance technique that only identifies live hosts by sending ICMP echo requests - it is far too narrow to test a broad range of security controls.