he is collecting system data for an upcoming internal system audit. he is currently performing vulnerability testing to determine what weaknesses may exist in the network's security. what form of assessment is he conducting?