The correct answer is D because application allow listing is one of the most effective preventive controls against ransomware execution. Allow listing permits only approved and authorized applications, scripts, or executables to run, thereby reducing the likelihood that malicious ransomware code can execute on endpoints or servers. An application deny list blocks known malicious applications, but it is less effective because attackers can modify filenames, hashes, or code to bypass known deny rules. A web security gateway can help reduce exposure to malicious downloads, phishing links, and compromised websites, but it does not fully prevent ransomware introduced through other channels. A host intrusion detection system may detect suspicious activity, but detection is reactive and may occur after ransomware has already started execution or encryption. CISM risk management principles favor preventive controls where feasible, especially for high-impact threats. Since ransomware success often depends on unauthorized code execution, application allow listing provides stronger protection than the other options.