Which of the following is/are applicable for 'internal testing' in penetration test tools?

This type of testing is performed by the organisation's IT team and the penetration testing team working together.

This type of testing targets a company's externally visible servers or devices including domain name servers (DNS), e-mail servers, etc.

This testing is useful for estimating how much damage a disgruntled employee could cause.

This type of testing involves simulation of the tools and procedures of a real attacker.

Both (2) and (3)