The correct answer is Nonfunctional security assessment.

A Nonfunctional security assessment is intended to evaluate attributes like scalability, reliability, and performance under operational load. It employs load testing, stress testing, and reliability or resilience testing to observe how the application and its security controls behave under expected and peak conditions. This assessment focuses on system behavior and endurance rather than just finding functional flaws, and that is why it best matches the requirements in the question.

Penetration testing is aimed at finding and exploiting vulnerabilities to demonstrate attack paths and risk, and it is not focused on measuring scalability or runtime performance under load.

Functional security validation verifies that security features such as authentication, authorization, and input validation work correctly and meet requirements, and it does not measure how the system performs under heavy operational load.

Attack surface analysis identifies exposed components and potential entry points to prioritize mitigation and testing, and it helps scope security work rather than measure scalability, reliability, or performance.

Full AWS Practitioner Certification Question