Which of the following assessments would Pete, the security administrator, use to actively test that an application’s security controls are in place?