conduct pen test