Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?

Conducting interviews provides anecdotal evidence and user understanding but does not directly prove the technical effectiveness or operational enforcement of controls.

Verifying that confidential files cannot be transmitted to a personal USB device directly tests the enforcement mechanism of DLP controls in a real-world, operational scenario. This hands-on method provides concrete evidence of whether the controls are operationally effective in preventing data exfiltration, rather than just confirming their existence or configuration.

Verifying software installation only confirms deployment, not whether the installed software is correctly configured, actively preventing data loss, or operationally effective.

Reviewing data classification levels is a review of policy and documentation, not an evaluation of the operational effectiveness of technical controls in practice.