Which method can provide a better return on IT security investment and provide a thorough and
comprehensive assessment of organizational security covering policy, procedure design, and implementation?

A.
Penetration testing

B.
Social engineering

C.
Vulnerability scanning

D.
Access control list reviews