Which of the following is the BEST way to evaluate the effectiveness of access controls to an internal network?