Which of the following activities BEST identifies operational problems, security misconfigurations, and malicious attacks?

Policy documentation review assesses whether written policies are complete and up to date, but does not actively detect live operational problems, misconfigurations, or attacks occurring in the environment.

Authentication validation verifies that authentication mechanisms are functioning correctly, but it is a narrow, targeted check that does not broadly identify security misconfigurations or malicious activity across systems.

Periodic log reviews involve systematically examining logs from systems, applications, firewalls, and security devices to detect anomalies, failed authentication attempts, policy violations, and indicators of compromise. Logs provide a historical record that can reveal patterns of misuse, misconfiguration symptoms, and active or past malicious activity that other point-in-time checks would miss. This makes log review a foundational security monitoring and operational assurance practice in frameworks like NIST SP 800-92.

Interface testing evaluates the functionality and connectivity of network or application interfaces, but it is not designed to detect security misconfigurations or identify malicious attack patterns.