Senior management has received a vulnerability scan report and asks whether an external attacker could actually chain the reported findings together to reach customer data. Which activity would BEST answer this question?
Select an answer to reveal the explanation.
Short Explanation
A scan is like a home inspector listing cracked windows; a penetration test is someone actually trying to climb through them to the safe. When management asks whether the attack works end to end, you need a test that actually tries it. The trap is a better scan, which still only lists the cracks.
Full Explanation
Vulnerability scanning identifies known weaknesses and configuration issues, but it does not show whether they can be exploited or combined into a path to a valuable asset. A penetration test, performed under written authorization with agreed scope and rules of engagement, attempts to exploit the weaknesses and pivot as a real attacker would, demonstrating whether customer data can actually be reached and through which chain of steps. That evidence is exactly what management needs to judge the real exposure. An authenticated rescan improves accuracy and coverage but remains a detection exercise; it still lists issues without proving exploitability. A configuration review against hardening baselines measures compliance with internal standards, not whether an attacker can reach data. A control self-assessment relies on system owners' judgement about their own controls, which is useful for awareness but provides no independent demonstration of attack paths. Exam caveat: the security manager's role is to ensure the test is authorized, scoped and its results are tied to risk, not to perform the exploitation. Operational check: confirm a signed authorization and scope exist before testing, and that the report maps each successful path to a risk owner and treatment plan.