Which of the following would be the BEST way for a risk practitioner to validate the effectiveness of a patching program?

Penetration testing aims to exploit vulnerabilities to assess overall security posture and is generally too broad and resource-intensive for directly validating a specific patching program's effectiveness.

Interviewing personnel provides subjective information about processes but does not objectively validate the technical outcome or effectiveness of the patching itself.

Vulnerability scans actively identify missing patches and known vulnerabilities on systems, directly demonstrating whether the patching program has successfully remediated these security weaknesses and providing an objective assessment of the program's real-world impact.

Reviewing change control documentation confirms that patches were approved and scheduled, but it does not confirm their actual successful deployment or remediation of vulnerabilities.