Which of the following security operations is used for determining the attack surface of an organization? 

Running a network scan to detect network services in the corporate DMZ 

Training employees on the security policy regarding social engineering 

Reviewing the need for a security clearance for each employee 

Using configuration management to determine when and where to apply security patches