John joined the ISC2 organization.

Security testing is used to verify that a specific control is functioning as intended. In this scenario, John wants to confirm that authentication controls operate correctly, which requires actively testing them under real or simulated conditions.

Security assessments evaluate overall security posture and risk, audits focus on compliance and policy adherence, and walkthroughs are informal reviews or demonstrations. None of these directly validate control effectiveness as precisely as testing.

Security testing may include functional testing, penetration testing, or control validation exercises to confirm expected behavior. For authentication controls, this might involve testing login mechanisms, MFA enforcement, failure handling, and session management.

NIST SP 800-53 and ISO/IEC 27001 both emphasize testing as a critical step in ensuring security controls are implemented correctly and remain effective over time.