During a healthcare IoT breach in Houston, Texas, examiners find multiple wearables still using out-of-box...

The correct answer is C because the scenario explicitly states that the devices were still using out-of-box credentials, which means the exposure was directly enabled by default passwords. OWASP guidance on default credentials explains that common factory usernames and passwords such as admin or simple preset values are a major weakness because attackers can guess or reuse them to gain unauthorized access. CHFI v11 includes IoT security problems and OWASP Top 10 IoT vulnerabilities, so candidates are expected to recognize default credentials as a direct and common cause of compromise in connected devices. The other options describe different security weaknesses, but they do not match the exact access path used here. Insecure APIs or weak encryption may create other risks, yet the question says the attackers leveraged unchanged default settings to bypass access controls. That points specifically to default passwords as the enabling condition. In forensic analysis, when the compromise path is tied to unchanged manufacturer credentials, the most precise and defensible answer is default passwords.