Which of the following would be used to identify the security posture of a network without actually exploiting any weaknesses?

A penetration test actively exploits identified vulnerabilities to demonstrate real-world impact, which goes beyond assessing posture to actually compromising systems.

A code review examines application source code for security flaws and does not assess the live network security posture.

A vulnerability scanner probes systems for known weaknesses, misconfigurations, and missing patches and reports findings without actually exploiting the vulnerabilities. This gives security teams visibility into the attack surface and security posture without causing harm or triggering incident conditions. The key distinction from a penetration test is that no exploitation occurs.

A brute force scan actively attempts to guess credentials, which constitutes exploitation of authentication mechanisms rather than passive assessment.