Explanation:

Web App security involves various elements to ensure the protection of the application and its data. The elements primarily focus on preventing unauthorized access, ensuring confidentiality, integrity, and availability of data. Among the options provided, "D) Penetration" is not a testable Web App security element.

1. Encryption:
Encryption is the process of converting data into a secure format to prevent unauthorized access. It involves using cryptographic algorithms to encrypt and decrypt data. Encryption ensures that sensitive information transmitted over the network or stored in databases is secure and cannot be easily understood by unauthorized individuals.

2. Authentication:
Authentication is the process of verifying the identity of a user or entity. It ensures that only authorized individuals have access to the web application. Authentication mechanisms can include passwords, biometrics, two-factor authentication, and other methods to validate the user's identity.

3. Authentication and Encryption:
Authentication and encryption are often used together to enhance the security of a web application. While authentication verifies the identity of the user, encryption ensures that the exchanged data remains confidential and cannot be intercepted or tampered with by attackers.

4. Penetration:
Penetration testing, also known as pen testing, is not an element of web application security but rather a testing methodology. It involves simulating real-world attacks to identify vulnerabilities and weaknesses in the application. Penetration testing helps uncover potential security flaws and allows developers to address them before they can be exploited by malicious actors.

Conclusion:
In summary, the options provided can be categorized as testable web app security elements except for "D) Penetration." Penetration testing is a methodology used to identify vulnerabilities but is not considered a standalone element of web app security.