Which of the following would verify that a threat does exist and security controls can easily be byp

Which of the following would verify that a threat does exist and security controls can easily be
bypassed without actively testing an application?

A.
Protocol analyzer

B.
Vulnerability scan

C.
Penetration test

D.
Port scanner