You're talking about the SAP configuration management system. The answer indeed is 2, cause CM is used to keep track of what you have been configuring in SAP.
- What kind of requirements are in the different versions -> true
- test results -> we're not keeping track of test results inCM
- differences in source code -> yes, it's like CVS
- restricted access to source code -> yes, you can jump from CM to any transaction in SPRO etc.