Which of the Following Best Describes an Assessment

Which of the following best describes an assessment?

A) Evidenced-based examination that compares current practices against a specific internal or external criteria
B) A focused privileged inspection to determine condition, locate weakness or vulnerabilities, and identity corrective actions
C) Testing controls by performing vulnerability assessment tests that simulate real attacks
D) Configuring the System and Security logs on each system to record and audit activities