Without a clear understanding of infrastructure and software, the leadership team must first conduct an inventory of assets. An asset inventory provides a comprehensive list of hardware, software, and services that support business operations.
Creating checklists, defining criteria, and assigning roles are important, but they rely on knowing what assets exist. Without an inventory, the disaster recovery plan would miss critical dependencies, making recovery incomplete or impossible.
Performing an inventory supports business impact analysis, risk assessments, and recovery prioritization. It ensures that all critical systems are accounted for and appropriate recovery strategies can be designed. Asset inventories are a foundational best practice for disaster recovery and continuity planning.

Content-based discovery involves searching within the actual text or binary content of documents to find matches for keywords, phrases, or patterns. In e-discovery, when the requirement is to locate documents containing a specific phrase, searching based on content is the most direct and reliable method.
Other approaches, such as metadata-based discovery, only examine properties like creation date or author, which do not reveal the presence of specific text. Label-based discovery relies on pre-applied classification labels, which may not always be accurate. Location-based discovery limits searches to folders or storage locations but does not guarantee relevance.
Content-based discovery provides completeness in legal and regulatory investigations. It ensures that no relevant documents are overlooked simply because of inconsistent labeling or metadata, thus supporting compliance and defensibility in court proceedings.

A vulnerability assessment requires compliance with the cloud service provider's terms of service.
Managing Cloud documentation explains that vulnerability scanning and testing can affect cloud infrastructure and other tenants if not properly authorized.
CSPs define acceptable testing activities to protect shared environments. Customers must follow these guidelines to avoid violating contracts or causing service disruptions. Many CSPs require prior notification or explicit permission before conducting vulnerability assessments.
The other methods involve internal development processes and do not impact cloud infrastructure directly.
Therefore, vulnerability assessment is the correct answer.

The described control isauthorization, which occurs after authentication. Authorization determines what resources a user can access based on their role, attributes, or policies stored in an access control database.
Authentication confirms identity, but authorization validates permissions. WAFs protect applications from malicious traffic, and antispyware tools detect malware. Neither applies to access decisions.
By checking users against a database of permissions, the organization enforces the principle of least privilege, ensuring employees only access the resources necessary for their role. This strengthens data protection, reduces insider threats, and aligns with compliance requirements for access governance.

Lightweight Directory Access Protocol (LDAP) provides common directory services. Managing Cloud principles explain that LDAP is used to store and retrieve information about users, groups, roles, and permissions in a centralized directory.
LDAP supports authentication, authorization, and identity management by enabling systems to query user attributes and access rights. It is widely used in enterprise and cloud environments to integrate applications with centralized identity services.
RADIUS and TACACS+ are authentication protocols, and DNS resolves domain names to IP addresses.
Therefore, LDAP is the correct entity for directory services.