For a semester exam, which option is correct about secure configuration management?

A. default passwords B. controlling and tracking secure settings, versions and changes C. manual undocumented changes D. uncontrolled production edits