An assessor sends a test message with a known malicious attachment to a mailbox to verify that the email security gateway actually quarantines it as designed. Which kind of testing is the assessor performing?
Select an answer to reveal the explanation.
Short Explanation
Functional testing asks 'does the control do its job?' Send the bad attachment, see if the gateway grabs it. Behavioral testing asks a different question: how your people react, like whether they click a phishing link. Don't mix the two just because both involve email.
Full Explanation
Functional testing verifies that a control operates as designed by exercising it and observing the result. Sending a message containing a known malicious test attachment and confirming that the email gateway quarantines it demonstrates that the filtering control works, not merely that it is configured. Functional tests produce direct evidence of control effectiveness and are commonly repeated after configuration changes. Behavioral testing evaluates how people act, for example whether employees report or click on a simulated phishing message; it measures human responses rather than the technical behavior of a security control. Benchmarking compares an organization's practices or performance with peers, industry figures, or published baselines; it might compare gateway catch rates against an industry figure but does not test the control directly. Passive reconnaissance gathers information about a target without interacting with its systems; sending a test message is an active interaction with a specific control and has nothing to do with information gathering. Exam caveat: a functional test that uses a safe, recognized test file shows the control detects known content, not that it will catch novel threats, so it should be combined with other assurance activities. Operational check: record the test message, the expected result, the observed result, and the gateway's log entry showing the quarantine action.