What does a penetration test do that a Vulnerability Scan does NOT?

Which three of the following characteristics form the AAA Triad in Information Security?
1. Authentication
2. Availability
3. Accounting
4. Asymmetry
5. Authorisation

What physical security control would be used to broadcast false emanations to mask the presence of true electromagentic emanations from genuine computing equipment?

What Is the KEY purpose of appending security classification labels to information?

How might the effectiveness of a security awareness program be effectively measured?
1) Employees are required to take an online multiple choice exam on security principles.
2) Employees are tested with social engineering techniques by an approved penetration tester.
3) Employees practice ethical hacking techniques on organisation systems.
4) No security vulnerabilities are reported during an audit.
5) Open source intelligence gathering is undertaken on staff social media profiles.