A security analyst is tasked with evaluating the security posture of a newly deployed application server. The server team insists the host is fully patched, but the analyst wants the most accurate picture of missing patches and risky local configuration settings, including registry values and installed software versions. Which assessment approach should the analyst recommend to obtain this level of detail?