An organization wants to be informed of any security exploits open in the cloud virtual environment that is being hosted in the organization's boundary. Which of the following will need to be…

A tabletop exercise is a discussion-based training session to test emergency response plans and procedures, not a technical method for actively discovering security exploits in a live system.

A vulnerability assessment is a systematic process of identifying, quantifying, and prioritizing the security weaknesses (vulnerabilities) in a system or network. This directly addresses the organization's need to be informed of any 'security exploits open' in its cloud virtual environment.

Separation of duties is an administrative control designed to prevent conflicts of interest or fraud by dividing critical tasks among multiple individuals, and it does not involve scanning for technical security exploits.

An audit review examines an organization's records, logs, and processes for compliance and policy adherence, which can identify control weaknesses but is not primarily focused on actively discovering unpatched software vulnerabilities or 'open exploits' in the same manner as a vulnerability assessment.