IT management has deployed a major update to reduce the risk of system compromise.

The correct answer is B because penetration testing validates whether the implemented control actually resists realistic compromise attempts. The uploaded CRISC notes state that penetration testing offers the greatest level of assurance regarding the effectiveness of implemented security controls and that penetration testing is the best way to ensure network security against external attacks.

ISACA also states that control testing demonstrates whether controls are mitigating risk as intended, including assessing network security and testing controls designed to prevent or detect unauthorized access, data breaches, and system failures. ISACA further explains that penetration testing evaluates vulnerabilities and supports effective risk response decisions.

C, vulnerability scanning, is useful for identifying known vulnerabilities, and it may be appropriate for validating a patching program. However, the question asks for the BEST way to validate effectiveness of a major update intended to reduce system compromise, making penetration testing stronger. A is too narrow because social engineering tests people rather than the technical control. D is only a metric and does not validate whether the update reduced compromise risk.