A recovery control is implemented but never exercised. Which test would best validate the required outcome?

1. Only checking that backup files have nonzero size
2. A review of the backup tool's sales brochure
3. A controlled restoration against defined business recovery criteria
4. Only counting recovery-plan pages