Listen to exam instructions

During a routine security audit, a cybersecurity analyst discovers several instances where unauthorized devices have been connected to the corporate network. These devices include personal smartphones, tablets, and even a smart speaker.

Upon further investigation, the cybersecurity analyst finds that these devices are being used to access corporate resources, including sensitive project files and email services. The analyst also notes that these devices are not managed by the company's IT department and do not comply with the company's security policies.

What type of security risk do these unauthorized devices represent, and what potential attack vector could they introduce?