The correct answer is B. To identify material information security vulnerabilities.
The primary purpose of a formal information security audit is to independently evaluate whether security controls are adequate and effective, and to identify material vulnerabilities, weaknesses, or risks that could affect the confidentiality, integrity, and availability of information assets. ISACA states that audit objectives often center on substantiating the existence of internal controls to minimize business risk, and ISACA's cybersecurity audit guidance describes reviewing gathered data to identify potential security vulnerabilities or risk and documenting findings and recommendations.
Option A is important, but it is more directly related to information security governance and strategy than the primary purpose of a formal audit. Option C is not correct because reducing software licensing cost is a cost- management activity, not the main objective of an information security audit. Option D is also incorrect because monitoring security team productivity is a management function, not the primary purpose of an independent audit.
This question maps mainly to Information Systems Auditing Process because it concerns why an audit is conducted: to provide independent assurance, identify material issues, and support risk-based recommendations.
References: ISACA CISA Exam Content Outline, Domain 1; ISACA Interactive Glossary, "Audit objective,"
"Audit evidence," and "Auditor's opinion"; ISACA article, Six Benefits of a Cybersecurity Audit.