CBC can conceal plaintext but lacks built-in integrity; modified ciphertext may pass unless a separate robust authentication mechanism is used.

ECB exposes repeating plaintext block patterns and provides no authentication tag to detect tampering.

An unkeyed checksum catches accidental corruption but can be recomputed by an adversary who changes the ciphertext.

CRCs detect accidental transmission changes but an adversary can modify both file and CRC without access to a signing key.

An attacker controlling the distribution endpoint can alter both the package and an unsigned checksum; it cannot substitute for signature-based origin assurance.

A shared exposed password provides no strong provenance because an attacker can use the same value to create altered packages.

Long-lived session keys magnify compromise impact because recorded traffic can be decrypted if the reused secret is later exposed.

Hashing can summarize content, but without authenticated ephemeral key agreement it does not confer forward secrecy.

Shared human passwords weaken identity assurance and do not create fresh independent session keys for each connection.

A hash detects accidental changes but an attacker can replace a message and calculate a matching new digest.

A timestamp can support freshness checks but can itself be altered unless authenticated with the message.

Compression may reduce size; it does not supply an integrity proof based on a secret known to the verifier.

Local authentication can permit access but lacks the centralized cross-gateway identity and accounting service required.

SAML may work with supported federated VPN solutions, but generic browser assertion exchange is not the specified conventional VPN AAA transport.

LDAP can validate users or supply directory attributes, but a VPN gateway normally requires a dedicated AAA exchange for access and accounting.

Complexity does not fix the cleartext management protocol and a read-write community expands management risk if exposed.

TFTP lacks built-in cryptographic authentication and encryption, potentially exposing configurations and sensitive settings.

Moving Telnet to another port does not encrypt credentials or management data transported over its session.

Logging after a broad allow does not prevent undesired flows and can make the supposed restrictions ineffective.

A denylist limited to known prior events leaves unexpected ports and new attack paths open.

Eliminating state tracking is not required to enforce an allowlist and may complicate safe return-traffic handling.

A stateless ACL does not inherently remember that inbound packets belong to a request initiated in the opposite direction.

NAT maps addresses and may track sessions for translation, but it does not itself supply the specified stateful firewall admission decision.

Two static permits can pass packets, but they do not track an established session to distinguish valid replies from unrelated inbound traffic.

A WAF inspects web requests to the protected app, whereas this task requires identifying and controlling employees' outbound applications.

DNS controls may block known domains, but cannot reliably classify every application operating through shared IPs and port 443.

Port filtering cannot reliably distinguish individual web applications that all use the same transport port.

Retrospective analysis supplies forensic evidence but cannot block packets at the moment they traverse the link.

A mirrored IDS can observe and alert but cannot directly prevent a packet already being forwarded along the primary path.

Correlating events helps analysts detect intrusions, but the dashboard alone is not an inline dropping point.

State tracking governs sessions, but ordinary allowed traffic may still carry the exploit unless appropriate inspection or prevention is enabled.

Restoration time is a service recovery metric, whereas the case is about incorrect IDS classification.

Fragmentation is a network property that may complicate inspection, but it is not the alarm-classification error described.

A false negative is malicious activity missed by detection, not a benign authorized scan that triggers an alarm.