This should be D. Testing a network's security controls to determine actual, exploitable vulnerabilities is called penetration testing.

This should be B - Notice the wording of the question - "Validating" you don't validate vulnerabilities by penetration testing. That's for Vulnerability scanning. The purpose of penetration testing is to determine if the security posture of the targets involved is robust and can withstand exploit attacks, if vulnerabilities are found then you exploit the vulnerabilities.