Which of the following is the BEST way to evaluate the effectiveness of access controls to an internal network?

A. Perform a system penetration test
B. Test compliance with operating procedures
C. Review access rights
D. Review router configuration tables