An organization migrated most of its physical servers to virtual ones in its own data center. Which of the following should be of GREATEST concern to an IS auditor reviewing the virtual environment?

A. Hypervisor access control lists are outdated.
B. The configuration management database (CMDB) does not include all virtual machines.
C. Hypervisors have not been updated with the most recent patches.
D. Virtual machine deployments are done without following an approved template.