Today’s SY0-701 CompTIA Security+ Pop Quiz: I’ll take the diet vulnerability

A retailer suffers a data breach after an attacker gains access to the corporate network using a third-party HVAC vendor's credentials. Which of the following most directly contributed to the attackers' ability to access sensitive data?