During what activity does an organization identify and prioritize technical, organizational, procedural, administrative, and physical security weaknesses?

During what activity does an organization identify and prioritize technical, organizational, procedural, administrative, and physical security weaknesses?
A . Table top exercise
B . Penetration testing
C . Vulnerability assessment
D . White box testing

Answer: C