Which of the following is NOT true regarding a vulnerability scan?

A$.$ It is an ongoing automated process used to identify weaknesses and monitor information security progress.

B$.$ Its purpose is to find weaknesses and address them in order to reduce the attack surface.

C$.$ It is an assessment that is designed to be a cyclical and continual scanning and monitoring process.

D$.$ It audits only the devices that are used but not the processes to protect devices.