A Chief Information Officer (CIO) publicly announces the implementation of a new financial system. As part of a security assessment that includes a social engineering task, which of the following tasks should be conducted to demonstrate the BEST means to gain information for a report on social vulnerability details about the financial system?
a) Phishing the employees
b) Conducting a penetration test
c) Reviewing source code
d) Analyzing network traffic