Which of the following should an IS auditor expect to see in a network vulnerability assessment?

A. Misconfiguration and missing updates
B. Malicious software and spyware
C. Security design flaws
D. Zero-day vulnerabilities