Company XYZ has transferred all of the corporate servers, including web servers, to a cloud
hosting provider to reduce costs. All of the servers are running unpatched, outdated versions of
Apache. Furthermore, the corporate financial data is also hosted by the cloud services provider,
but it is encrypted when not in use. Only the DNS server is configured to audit user and
administrator actions and logging is disabled on the other virtual machines. Given this scenario,
which of the following is the MOST significant risk to the system?

A.
All servers are unpatched and running old versions.

B.
Financial data is processed without being encrypted.

C.
Logging is disabled on critical servers.

D.
Server services have been virtualized and outsourced.