During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply
with policy. Six months later, the company is audited for compliance to regulations. The audit
discovers that 40% of the desktops do not meet requirements. Which of the following is the cause
of the noncompliance?

A.
The devices are being modified and settings are being overridden in production.

B.
The patch management system is causing the devices to be noncompliant after issuing the
latest patches.

C.
The desktop applications were configured with the default username and password.

D.
40% of the devices have been compromised.