When a security analyst prepares for the formal security assessment, what of the following should be done in order to determine inconsistencies in the secure assets database and verify that system is

Data items review combined with vulnerability scanning directly compares the current state of assets against the documented secure asset database, surfacing inconsistencies. Vulnerability scanning also maps discovered issues against the minimum security baseline to confirm or deny compliance. This two-pronged approach is the standard technical method used in formal security assessments for asset validation.

Interviewing employees and engineers is a qualitative information-gathering technique and does not produce the technical data needed to identify database inconsistencies or measure baseline compliance.

Reviewing firewall configurations addresses network access controls only and does not cover the broader set of assets or baseline requirements across the entire system.

Source code review is used to find software vulnerabilities in application logic, not to audit asset databases or verify system-wide security baseline compliance.