An insurance company is looking to purchase a smaller company in another country. Which of the following tasks would the security administrator perform as part of the security due diligence?

Reviewing individual switch and router configurations is a granular, operational-level activity that does not provide the governance overview and risk assessment required for acquisition due diligence.

Security policies and standards reflect the target company's security governance maturity, regulatory compliance posture, risk management practices, and overall program effectiveness - the primary concerns when evaluating inherited risk in an acquisition. This review identifies systemic liabilities, compliance gaps, and risk exposure that the acquiring company would assume without requiring intrusive or disruptive access to the target's infrastructure. It provides the broadest and most strategically relevant security risk assessment appropriate to an international acquisition context.

A penetration test is an active, intrusive engagement requiring explicit written authorization, legal agreements, and significant coordination - it is not a standard or appropriate component of initial security due diligence in an M&A context.

Reviewing firewall rule sets and IPS logs is a narrow technical activity focused on specific operational controls rather than the broad security posture and policy framework that due diligence requires.