A client maintains a large data center where access is limited to authorized employees. How may an auditor best determine the effectiveness of this control activity? a. Ask the chief technology officer about known problems. b. Obtain a list of current data center employees. c. Observe whether the data center is monitored. d. Inspect the policy manual establishing this control activity.