Which type of penetration test is used to ensure compliance with federal laws and regulations?

• A. Red-team assessment
• B. Black-box testing
• C. Social engineering
• D. Compliance-based

Answer: (D)

Regulatory compliance testing focuses on proving that security controls, governance, and documentation satisfy applicable federal laws and standards, and that evidence can be produced for audits. A compliance-based penetration test is designed to validate that the organization not only has defenses but also can demonstrate adherence to federal requirements by mapping controls to regulations, checking policy coverage, configurations, and log retention, and producing audit-ready results. The other approaches are attack-oriented or people-oriented: red-team assessments simulate real-world adversaries to test detection and response without focusing on regulatory paperwork; black-box testing examines external vulnerabilities with no internal knowledge; social engineering evaluates how people can be manipulated, which is about risk to humans rather than legal compliance. Therefore, compliance-based testing is the option that ensures alignment with federal laws and regulations.