A company has decided to lower costs by conducting an internal assessment on specific devices and various internal and external subnets. The assessment will be done during regular office hours, but…

An agent-based vulnerability scan actively probes systems and generates traffic that can trigger responses, consume resources, or crash services on production servers during business hours.

Black-box penetration testing uses aggressive, active exploitation techniques conducted by external parties, which both risks disrupting production systems and contradicts the goal of lowering costs.

Configuration review is a passive, read-only examination of device and system settings that generates no network traffic or active probing, making it safe to run during business hours without any risk to production servers. It is also entirely internal and low-cost, fitting the budget reduction goal while still covering specific devices and subnets.

Social engineering targets human behavior through deception and is unrelated to assessing specific devices or internal and external subnets for technical vulnerabilities.

Malware sandboxing is a technique for safely executing suspicious files to observe their behavior and is not a method for assessing network devices or subnets.

A tabletop exercise is a discussion-based activity where participants walk through scenarios without interacting with live systems, producing no network traffic or system load that could affect production, and it can be conducted entirely with internal staff at minimal cost.