An Access Control List (ACL) is a technical mechanism used to explicitly define permissions for files, folders, or other resources. ACLs specify which users or system processes are granted access to objects and what operations are allowed on given objects. This allows the administrator to centrally and granularly manage file permissions for a group or team.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 3.1, "Access control lists (ACLs) are used to explicitly define permissions to files and resources for users and groups." Exam Objectives 3.1: "Implement secure network architecture concepts."

Change management is the formal process designed to control, document, approve, and track modifications to systems, internal processes, assets, and security controls. This control mechanism helps prevent unauthorized or unintended changes that could introduce vulnerabilities or disrupt operations.
Playbooks are documented procedures for responding to incidents, incident response manages security incidents, and acceptable use policies define acceptable user behavior but do not directly control changes.
By enforcing proper change management, organizations maintain the integrity and security of their infrastructure, which is a critical topic covered in the Security Program Management and Oversight domain of SY0-701#6:Chapter 16 CompTIA Security+ Study Guide#

The correct answer is B. Port mirroring.
Port mirroring, also known as SPAN, copies network traffic from one or more switch ports or VLANs to another port where a monitoring tool, packet analyzer, IDS, or SIEM-related sensor can inspect the traffic.
This is the most appropriate method when the goal is to collect network traffic directly from a switch to gain visibility into network activity.
Why the other options are incorrect:
A). Syslog
Syslog collects log messages from systems, applications, and network devices. It is useful for SIEM log ingestion, but it does not capture full network traffic from a switch.
C). Port forwarding
Port forwarding redirects traffic from one port or IP address to another, commonly used for NAT or remote access. It is not used to monitor switch traffic.
D). Load balancer logs
Load balancer logs provide information about traffic passing through a load balancer, but they do not provide broad switch-level network visibility.
Therefore, the best answer is port mirroring.

Memory injection vulnerabilities allow unauthorized code or commands to be executed within a software program, leading to abnormal behavior such as generating outbound traffic over random high ports. This issue often arises from software not properly validating or encoding input, which can be exploited by attackers to inject malicious code.References: CompTIA Security+ SY0-701 course content and official CompTIA study resources.