Penetration testing is the most useful method for identifying security control gaps on an application server because it simulates real-world attacks and exploits the vulnerabilities and weaknesses of the application server. Penetration testing can reveal the actual impact and risk of the security control gaps, and provide recommendations for remediation and improvement.
References: The CISM Review Manual 2023 defines penetration testing as "a method of evaluating the security of an information system or network by simulating an attack from a malicious source" and states that
"penetration testing can help identify security control gaps and provide evidence of the potential impact and risk of the gaps" (p. 185). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following rationale for this answer: "Penetration testing is the correct answer because it is the most useful method for identifying security control gaps on an application server, as it simulates real-world attacks and exploits the vulnerabilities and weaknesses of the application server, and provides recommendations for remediation and improvement" (p. 95). Additionally, the web search result 4 states that "penetration testing is a valuable tool for discovering security gaps in your application server and network infrastructure" and that
"penetration testing can help you assess the effectiveness and efficiency of your security controls, and identify the areas that need improvement or enhancement" (p. 1).