An organization wants to be informed of any security exploits open in the cloud virtual environment that is being hosted in the organization's boundary. Which of the following will need to be performe

A tabletop exercise is a discussion-based simulation of an incident response scenario and does not scan or detect actual technical vulnerabilities in a live environment.

A vulnerability assessment is the systematic process of scanning and identifying security weaknesses, misconfigurations, and open exploits in a system or environment. For a cloud virtual environment hosted within the organization's boundary, performing a vulnerability assessment will actively detect exploitable security gaps and produce an actionable findings report. This directly fulfills the requirement to be informed of open security exploits.

Separation of duties is an access control principle that divides critical responsibilities among multiple individuals to reduce insider risk, not a method for detecting open security exploits.

An audit review examines historical logs and compliance records after the fact and does not actively identify or enumerate open exploits in a running environment.