An authorized internal assessment needs to identify active hosts and exposed services on a defined subnet. What should guide scanning intensity?

1. The fastest possible rate regardless of device type
2. Whether unrelated internet addresses respond faster
3. A requirement to disable all client monitoring first
4. The rules of engagement and the sensitivity of target systems