Exam CISM topic 1 question 854 discussion

The verb "introduce" leads us to think about change

Among the options provided, B. Change management controls are MOST effective in preventing the introduction of vulnerabilities that may disrupt the availability of a critical business application. While options A (patch management process), C (version control), and D (logical access controls) are important security measures, they are not specifically focused on preventing the introduction of vulnerabilities that disrupt the availability of critical business applications. Patch management and version control primarily address software updates and versioning, while logical access controls focus on controlling user access to systems and data.

The most likely answer is B, Change Management Controls. Note that the question is specifically referring to the 'introduction' of vulnerabilities, which most often happens when changes are made to the system without a proper change management process in place. A change management process can include patch management to fix the vulnerabilities introduced. Version control is part of change management. Access control is used to reduce the likelihood of a threat (an attacker gaining access to a critical system) rather than mitigate a vulnerability (the critical system itself need not have any vulnerability).

B. Change management controls

I would suggest A