A business may devote significant resources to implementing security controls that are irrelevant to the threats it is trying to mitigate. Which of the following is an example of this sort of mismatch?

Group of answer choices Using firewalls to prevent data theft from applications that areallowed to operate through the firewall

Using standard antivirus tools that are effective only againstpreviously identified threats, to protect against zero-day attacks

Using controls at the operating-system level to detect Application layer attacks

Requiring authorized company-issued ID badges to enter secured spaces.