Which of the following is the BEST approach to identify whether a vulnerability is actively being exploited?

A. Implement key performance indicators (KPIs).
B. Conduct a penetration test.
C. Review service desk reports.
D. Perform log analysis.