During a routine penetration test of a customer's physical data center, a penetration tester observes that no changes have been made to the production firewalls in more than five years. Which of the…

Video surveillance is a physical security control, not a direct remediation for network device access security issues.

Biometric controls are also physical security mechanisms, not directly related to securing remote access to firewalls.

Password encryption is generally assumed for storing passwords, but SSH often uses key pairs for more secure authentication, and 'password encryption' as a standalone remediation is less specific or effective for remote access than key rotation.

Firewalls, like many network devices, are typically accessed and managed via SSH for remote administration. If no changes have been made in five years, it implies SSH keys may be static and potentially compromised or known to former employees. Regular SSH key rotation is a critical security practice that ensures keys are regularly changed, reducing the window of opportunity for attackers to use stolen or compromised keys to gain unauthorized access to the firewall.