Application containers are a form of operating system virtualization that share the same kernel as the host operating system. This means that any vulnerability or compromise in the kernel can affect all the containers running on the same host, as well as the host itself. Additionally, containers may have privileged access to the kernel resources and functions, which can pose a risk of unauthorized or malicious actions by the container processes. Therefore, securing the kernel is a critical aspect of application container security.
Shared registries (option A) are not an inherent risk in the application container infrastructure, but they are a potential risk that depends on how they are configured and managed. Shared registries are repositories that store and distribute container images. They can be public or private, and they can have different levels of security and access controls. Shared registries can pose a risk of exposing sensitive data, distributing malicious or vulnerable images, or allowing unauthorized access to images. However, these risks can be mitigated by using secure connections, authentication and authorization mechanisms, image signing and scanning, and encryption.
Host operating system (option B) is not an inherent risk in the application container infrastructure, but it is a potential risk that depends on how it is configured and maintained. Host operating system is the underlying platform that runs the application containers and provides them with the necessary resources and services.
Host operating system can pose a risk of exposing vulnerabilities, misconfigurations, or malware that can affect the containers or the host itself. However, these risks can be mitigated by using minimal and hardened operating systems, applying patches and updates, enforcing security policies and controls, and isolating and monitoring the host.
Shared data (option C) is not an inherent risk in the application container infrastructure, but it is a potential risk that depends on how it is stored and accessed. Shared data is the information that is used or generated by the application containers and that may be shared among them or with external entities. Shared data can pose a risk of leaking confidential or sensitive data, corrupting or losing data integrity, or violating data privacy or compliance requirements. However, these risks can be mitigated by using secure storage solutions, encryption and decryption mechanisms, access control and auditing policies, and backup and recovery procedures.
Therefore, option D is the correct answer.
References:
Application Container Security Guide | NIST
CSA for a Secure Application Container Architecture
Application Container Security: Risks and Countermeasures

The best answer is B. Senior management.
The culture that supports an effective internal control system is set from the top. ISACA's governance and culture guidance consistently treats culture as a management and leadership responsibility. Senior leadership establishes tone, values, expectations, accountability, and behavioral norms that shape how controls are designed, followed, and enforced across the enterprise. A strong control culture depends on visible commitment from leadership, not just procedural ownership by operational teams.
Option A. HR supports the culture through hiring, training, and policy reinforcement, but HR does not have primary accountability for the overall control environment.
Option C. Line management plays an important role in day-to-day control execution, but enterprise culture is primarily driven by senior leadership.
Option D. Internal audit evaluates and provides assurance over the control system; it does not own or establish the control culture because doing so would impair independence.
Therefore, B is the correct answer because senior management is primarily accountable for establishing the tone and culture that enable an effective and efficient internal control system.
References (Official ISACA):
* ISACA Journal, Auditing Your Organizational Culture.
* ISACA Now Blog, Culture as a Corporate Asset.
* ISACA Digital Video/Podcast, Understanding and Assessing Organization Culture.
* ISACA Journal, Auditing Culture.

Comprehensive and Detailed Explanation:
The best approach is to establish a clear AI acceptable use policy that defines how employees may use AI tools while protecting sensitive information and intellectual property. This ensures governance while enabling safe adoption.
Option B: Reactive and punitive, not proactive governance.
Option C: Monitoring helps but is insufficient alone.
Option D: Overly restrictive and may block beneficial AI use.
Option A: Correct - policies provide structured guidance aligned with business objectives and risk management.
# ISACA Reference: ISACA whitepapers on AI governance, risk, and compliance; CISA Review Manual
27th Edition, Domain 1, section on policy frameworks and emerging technologies.