A security firm is writing a response to an RFP from a customer that is building a new network based software product. The firm’s expertise is in penetration testing
corporate networks. The RFP explicitly calls for all possible behaviors of the product to be tested, however, it does not specify any particular method to achieve this
goal. Which of the following should be used to ensure the security and functionality of the product? (Select TWO).

A.
Code review

B.
Penetration testing

C.
Grey box testing

D.
Code signing

E.
White box testing