A Chief Security Officer $($CSO$)$ is concerned about the number of successful ransomware attacks

that have hit the company. The data indicates most of the attacks came through a fake email. The

company has added training, and the CSO now wants to evaluate whether the training has been

successful. Which of the following should the CSO implement?

A$.$ Simulating a spam campaign

B$.$ Conducting a sanctioned vishing attack

C$.$ Performing a risk assessment

D$.$ Executing a penetration test