Which of the following is the BEST way to determine whether system settings are in alignment with control baselines?

Configuration validation involves regularly comparing a system's current settings and configurations against established security baselines or desired state configurations to identify any deviations. This automated or manual process directly verifies alignment with control requirements, such as hardening standards or policy settings, ensuring continuous compliance and security posture.

Control attestation is a formal statement or affirmation that controls are in place and operating effectively, often based on reviews or audits, rather than a direct technical method for checking system settings.

Penetration testing simulates an attack to find vulnerabilities and exploit them; it assesses the effectiveness of security controls in practice but is not primarily designed to check compliance with configuration baselines.

An internal audit review examines processes and evidence of control effectiveness; while it might include checking configuration, it's a broader governance activity, and configuration validation is the specific technical method.