Câu 264: CISA: Certified Information Systems Auditor

An IS auditor reviewing an information processing environment decides to conduct external penetration testing. Which of the following is MOST appropriate to include in the audit scope for the organization to distinguish between the auditor's penetration attacks and actual attacks?

1. A. Restricted host IP addresses of simulated attacks
2. B. Testing techniques of simulated attacks
3. C. Source IP addresses of simulated attacks — đáp án hiện tại
4. D. Timing of simulated attacks