What kind of penetration test would you recommend that would best address the client’s concern?