A penetration test performed as part of evaluating network security:

A.
provides assurance that all vulnerabilities are discovered.

B.
should be performed without warning the organization’s management.

C.
exploits the existing vulnerabilities to gain unauthorized access.

D.
would not damage the information assets when performed at network perimeters.

Explanation:
Penetration tests are an effective method of identifying real-time risks to an information processing
environment. They attempt to break into a live site in order to gain unauthorized access to a system.
They do have the potential for damaging information assets or misusing information because they
mimic an experienced hacker attacking a live system. On the other hand, penetration tests do not
provide assurance that all vulnerabilities are discovered because they are based on a limited
number of procedures. Management should provide consent for the test to avoid false alarms to IT
personnel or to law enforcement bodies.