During the physical security audit, the information system auditor received a contactless proximity card that allowed to access to three specific floors of the corporate office building.
Which of the following questions should be the biggest concern?
A. In the first two days of field work of audit, the proximity card did not work.
B. No follow-up was made for unsuccessful attempts to access violations.
C. The proximity card incorrectly grants access to the restricted zone
D. No escort required during field work.