Which of the following statements pertaining to ethical hacking is incorrect?

A.
An organization should use ethical hackers who do not sell auditing, consulting, hardware,
software, firewall, hosting, and/or networking services

B.
Testing should be done remotely

C.
Ethical hacking should not involve writing to or modifying the target systems

D.
Ethical hackers should never use tools that have potential of exploiting vulnerabilities in the
organizations IT system.