A security group managed by CloudFormation was manually modified in the console. The team wants to identify differences between supported resource properties and the stack template without applying another deployment. Which operation should it run?

1. Run ValidateTemplate against the last deployed template and expect it to query actual security group rules.
2. Run a syntax linter on the template and infer the deployed security group rules from the result.
3. Execute a change set with the existing template and assume it is a drift-only report.
4. CloudFormation drift detection on the stack, followed by inspection of the affected resource differences.