Which activity is described as the attempt to enter a system or network through an unauthorized channel?

• A. Policy
• B. Risk Management
• C. Legacy IT Systems
• D. Penetration Testing

Answer: (D)

Penetration testing is about simulating an attacker by attempting to breach a system or network through channels an attacker might use, all within a controlled and authorized scope. This practice aims to uncover vulnerabilities, test defenses, and measure how well access controls, network segmentation, and monitoring stand up to real intrusion techniques. The activity is designed to reveal what could be exploited and how detections and responses would perform, so remediation can be planned accordingly. In contrast, policy governs rules and behavior, risk management covers identifying and mitigating risks, and legacy IT systems refer to old technology—not the act of attempting unauthorized entry.