Which factors expand an organization's attack surface?

• A. New systems, integrations, users, vendors.
• B. Increased firewall rules.
• C. More security training for staff.
• D. Expanded data center footprint.

Answer: (A)

Expanding an organization’s attack surface happens when you introduce new entry points and trust relationships: new systems, new integrations, more users, and more vendors. Each addition adds interfaces, data flows, and potential misconfigurations that an attacker could exploit, widening the ways someone could breach defenses. While increasing firewall rules can help block traffic, and security training aims to reduce risk, and a larger data center footprint may bring more devices to secure, the most direct driver of a broader attack surface in this context is the introduction of new systems, integrations, users, and vendors.