When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected on the network? 
A、Use the IP address of an existing file server or domain controller. 
B、Pause the scanning every few minutes to allow thresholds to reset. 
C、Conduct the scans during evening hours when no one is logged-in. 
D、Use multiple scanning tools since each tool has different characteristics.