An organisation engages a third party for a black-box penetration test of its internet-facing applications. The test report lists several exploitable vulnerabilities. From an information security management perspective, what is the most important reason to also perform internal control testing rather than relying on the penetration test alone to evaluate the control environment?
- AA penetration test is performed by an external party, so its findings cannot be used as audit evidence without internal corroboration.
- BA penetration test only covers the network layer, so application and data-layer controls are always outside its scope.
- CA penetration test produces false positives that must be re-validated, which internal control testing is designed to eliminate.
- DA penetration test confirms exploitability of weaknesses found but does not evaluate whether preventive and detective controls across the environment are operating as intended. Correct
Why A is wrong: This is tempting because independence and evidence handling matter, but external test results are routinely valid evidence; the real limitation is scope, not the tester's external status, so this misstates the reason.
Why B is wrong: This sounds plausible, but the scenario describes an application penetration test, and penetration tests can target application and data layers; the blanket claim about scope is factually wrong.
Why C is wrong: Re-validating findings is a real activity, but eliminating false positives is not the purpose of internal control testing, and a clean penetration test would still leave the wider control environment unevaluated, so this misidentifies the main reason.
Why D is correct: Penetration testing demonstrates whether specific attack paths can be exploited at a point in time; it is not a systematic evaluation of whether each designed control operates as intended, so broader control testing is needed to evaluate the control environment.