A Business Manager Is Arguing with a Compliance Officer That

Multiple Choice

A business manager is arguing with a compliance officer that a pentest would never be necessary for this company since they use single sign on authentication throughout. You are asked for your opinion, and say "IF I can access a network physically I can own it". This sounds a little extreme, but what is not true about this assertion?

A) Booting up to an alternative operating system might allow you to circumvent the local authentication, compromise a credential store, or steal critical data
B) Not being able to login would prevent your host from obtaining network configurations such as an IP address, routing and DNS settings. But sniffing is still possible.
C) There are ways of detecting the presence of new systems on the network such as rogue infrastructure. These techniques should still be tested regularly
D) Physical security is always critical and along with user training should be a constantly run program