Which of the following describes the process in the case that an organization must decide what areas of operation can be included in a penetration test and what areas cannot be included after performing a risk assessment?