The most appropriate control to prevent unauthorized retrieval of confidential information stored in a business application system is to enforce an internal data access policy. A data access policy defines who can access what data, under what conditions and for what purposes. It also specifies the roles and responsibilities of data owners, custodians and users, as well as the security measures and controls to protect data confidentiality, integrity and availability. By enforcing a data access policy, the organization can ensure that only authorized personnel can retrieve confidential information from the business application system. Applying single sign-on for access control, implementing segregation of duties and enforcing the use of digital signatures are also useful controls, but they are not sufficient to prevent unauthorized data retrieval without a clear and comprehensive data access policy. References:
* CISA Review Manual, 27th Edition, page 2301
* CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2

Enterprise Architecture (EA) documentation primarily includes strategic and operational blueprints outlining the evolution of IT infrastructure to align with business goals. Roadmaps showing the evolution from current state to future state (C) are essential for understanding how the organization's IT environment will change over time to support business strategy.
Other options:
Contact information for key resources (A) is more of an operational or administrative document rather than an EA component.
Detailed encryption standards (B) would typically be found in security policies or system-specific documentation rather than in EA documentation.
Protocols used to communicate between systems (D) are typically documented within network or system architecture diagrams rather than high-level EA documentation.
Reference: ISACA CISA Review Manual, IT Governance and Management of IT