Explanation/Reference:
Explanation:
SQL injection vulnerability arises when crafted or malformed user inputs are substituted directly in SQL queries, resulting into information leakage. Hardening the database listener does enhance the security of the database; however, it is unrelated to the SQL injection vulnerability. Normalization is related to the effectiveness and efficiency of the database but not to SQL injection vulnerability. SQL injections may also be observed in normalized databases. SQL injection vulnerability exploits the SQL query design, not the operating system.

Explanation
Change is a process in which new risks can be introduced into business processes and systems. For this reason, risk management should be an integral component of the change management process. Policy development, awareness training and regular monitoring, although all worthwhile activities, are not as effective as change management.

The correct answer is C because penetration testing provides practical evidence of whether compensating controls can resist real-world attack techniques against the legacy application. When an application cannot be patched, compensating controls such as web application firewalls, network segmentation, access restrictions, monitoring, or virtual patching may be used to reduce risk. However, the effectiveness of those controls should be validated through testing that simulates attacker behavior. A threat assessment identifies potential threats, but it does not prove whether controls are working. Intrusion detection system logs may show detected activity, but they provide only a partial and reactive view. Firewall rules can be reviewed, but rule review alone does not demonstrate whether the total control environment prevents exploitation. Penetration testing is more useful because it tests the application and compensating controls together under realistic conditions. CISM emphasizes risk-based control validation, especially where vulnerabilities cannot be remediated directly. Therefore, penetration testing provides the best information about compensating control effectiveness.
Reference: CISM Information Risk Management; compensating controls, vulnerability management, penetration testing, and control effectiveness principles.