which of the following is the BEST thing to do?

If you are to determine the attack surface of an organization, which of the following is the BEST thing to do?

A.
Running a network scan to detect network services in the corporate DMZ

B.
Reviewing the need for a security clearance for each employee

C.
Using configuration management to determine when and where to apply security patches

D.
Training employees on the security policy regarding social engineering