The correct answer is D. The remediation was technically successful, but it took place during five business hours on a sales application. That likely caused business process interruption and lost sales. The problem was not the patch itself; the problem was poor change scheduling and communication.
Exact supporting extract: the Sybex CySA+ Study Guide states that changes can be disruptive and that the timing of changes should be carefully coordinated. It also explains that maintenance windows usually occur during evenings, weekends, or other periods when business activity is low.
The official CySA+ objectives also list patching, business process interruption, degrading functionality, SLAs, SLOs, and stakeholder communication as key vulnerability management reporting and communication concerns.
Why the other options are incorrect:
A is incorrect because this was avoidable operational loss caused by poor scheduling.
B is incorrect because the issue is not specifically board notification by the CIO.
C is incorrect because a penetration test is not required before every patch.
D is correct because a properly scheduled and communicated maintenance window should reduce business impact.