As part of a security compliance assessment, an auditor performs automated vulnerability scans. In addition,
which of the following should the auditor do to complete the assessment?


A. User behavior analysis
B. Packet captures
C. Configuration reviews
D. Log analysis