An auditor is reviewing an organization’s virtual machines (VMs) hosted in the cloud. The organization
utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the
following is the BEST approach for the auditor to use to review the operating effectiveness of the password
requirement?