At a bank, a server's running configuration no longer matches the approved baseline, and no change ticket exists for the difference. Which practice addresses this gap?

Configuration management, the running setup drifted from the approved baseline with no change ticket is the practice that owns this gap. Configuration management keeps the running setup aligned to the approved baseline and expects a change ticket when they differ. The bank server no longer matches that baseline, and no ticket exists. Asset inventory, the practice that still lists this server even after its running setup has drifted from baseline still lists the server. Inventory answers whether the bank knows the machine exists. The scenario says the server is known well enough that its running setup can be compared with a baseline, so the list is not the practice that failed. Vulnerability scanning treated as the entire practice for keeping this server aligned to policy can notice a risky setting during a scan. It is not the practice that defines the approved baseline or that requires the missing ticket, so treating the scan as the whole answer stops short of the control that owns the approved state. Chain of custody, the record of who handled evidence after a bank incident was opened and sealed records who handled evidence after an incident was opened. A missing ticket for a drifted build is not chain of custody. Exam caveat: a vulnerability scan may reveal drift, but the practice that sets the baseline and the ticket is configuration management. Operational check: compare the running configuration with the approved baseline and require a change ticket for every difference that remains.