The kind of security assessment notifies the client of vulnerabilities but does not actively or intentionally exploit them is which of the following?

Vulnerability assessments (also known as security audits) look for open vulnerabilities on a client's systems but do not actively or purposefully attack any of them.