CompTIA CySA+ (CS0-003) CS0-003 — Question 1

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?