CompTIA Security+ (SY0-701) SY0-701 — Question 326

An administrator wants to perform a risk assessment without using proprietary company information. Which of the following methods should the administrator use to gather information?