Exam SSCP topic 2 question 32 discussion

Tricky question. The question is asking how do say tests and evaluations in other words. The key part of the question is "which of the following is the act of performing tests and evaluations." The distractor part is "to test a system's security level to see if it complies with the design specifications and security requirements?"

The question states "Design Specification" which is geared more towards verification than assessment.

C. Assessment The act of performing tests and evaluations to test a system's security level to see if it complies with the design specifications and security requirements is referred to as "Assessment." This process involves evaluating the system's security controls, configurations, vulnerabilities, and overall effectiveness in meeting the defined security criteria. The goal is to identify potential weaknesses or gaps in the system's security posture and recommend necessary improvements or mitigations.

I think the answer to this question is C, "Assessment". Verification is when you verify if security controls are in place or not which is why I think it verification is the wrong answer. I welcome all of your opinions