Security Assessment and Testing
What each test proves
A vulnerability assessment enumerates weaknesses; a penetration test exploits them to demonstrate impact; an audit checks evidence against a standard; a security review examines design. Written authorization, scope, and rules of engagement precede any active test. Black-box testing assumes no knowledge, white-box full knowledge, gray-box partial. Automated scanners produce false positives that require validation before reporting.
Code and coverage
Static analysis (SAST) reads source without executing it; dynamic analysis (DAST) exercises running code; fuzzing feeds malformed input; synthetic transactions monitor business flows end to end. Test coverage matters: a control never exercised cannot be trusted, a favorite phrasing in exam items.
Logs and audit reports
Logs must be protected, time-synchronized with NTP, retained per policy, and reviewed. Sampling versus full review is a cost trade-off. SOC 1 covers financial reporting controls; SOC 2 covers security, availability, processing integrity, confidentiality, and privacy; SOC 3 is a public seal. Type I is a point in time; Type II covers a period - a reliable trap.
Business continuity testing
Increasing rigor: checklist review, structured walkthrough, simulation, parallel processing, full interruption. Full interruption is most realistic and most risky; parallel is common for critical systems.
Worked example
Assurance that a vendor's controls operated effectively across twelve months requires a SOC 2 Type II report. Type I only describes design at a point in time. Matching report type to the question's time frame answers the item.