Which of the following would verify that a threat does exist and security controls can easily be bypassed without actively testing an application?

a) Vulnerability assessment
b) Penetration testing
c) Risk assessment
d) Security audit