ISC2 CISSP Practice Question

Configuration Management Database (CMDB) is the correct answer because it provides a centralized repository for information about all configuration items (CIs) in the IT environment. During the operations and maintenance phase of the information system lifecycle, a CMDB helps track relationships between system components, manage changes to the infrastructure, and maintain an authoritative record of the system state. This allows the organization to understand dependencies between components, analyze the impact of changes before implementation, and quickly identify what changed when issues arise.

A vulnerability management system focuses on identifying and addressing security vulnerabilities rather than tracking system configurations and changes. While incident response procedures are important, they are reactive measures that wouldn't prevent systemic change control issues. Disaster recovery plans focus on recovering systems after major disruptions, not on day-to-day management of changes during normal operations.