Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering policy, procedure

design, and implementation?

A. Penetration testing

B. Social engineering

C. Vulnerability scanning

D. Access control list reviews