Penetration testing is used to do what?

Penetration testing is used to do what?

• A. Train staff
• B. Replace security policy
• C. Used to find vulnerabilities and document weaknesses
• D. Audit financial records

Answer: (C)

Penetration testing is about actively probing a system to uncover vulnerabilities and weaknesses, then documenting what was found with evidence and risk context so they can be fixed. This hands-on approach simulates how an attacker might exploit flaws, providing concrete insight into where security controls fail and what remediation is needed. That makes it the best description for what penetration testing is used for. Training staff focuses on awareness, not discovering system weaknesses. Replacing security policy is a governance task, not a testing activity. Auditing financial records is unrelated to testing the security of systems.

Penetration testing is about actively probing a system to uncover vulnerabilities and weaknesses, then documenting what was found with evidence and risk context so they can be fixed. This hands-on approach simulates how an attacker might exploit flaws, providing concrete insight into where security controls fail and what remediation is needed. That makes it the best description for what penetration testing is used for. Training staff focuses on awareness, not discovering system weaknesses. Replacing security policy is a governance task, not a testing activity. Auditing financial records is unrelated to testing the security of systems.