Which of the following should a security team use to document persistent vulnerabilities with related recommendations?

A risk register is the appropriate tool for documenting persistent vulnerabilities and their associated recommendations. It provides a centralized, dynamic record of identified risks, their potential impact, likelihood, and the planned mitigation strategies, including recommendations for remediation. This allows for ongoing tracking and management of security posture. An audit report summarizes findings from a formal review, often a snapshot in time, rather than a living document for persistent issues. A compliance report assesses adherence to specific regulations or standards, not a general vulnerability tracking tool. A penetration test is an activity to find vulnerabilities, not a document for managing them over time.