A web server, which is configured to use TLS with AES-GCM-256, SHA-384, and ECDSA, recently suffered an information loss breach. Which of the following is MOST likely the cause?

AES-GCM-256 utilizes a 256-bit key, which is considered a very strong key length and not insufficient.

The combination of AES-GCM-256 for encryption, SHA-384 for hashing, and ECDSA for digital signatures constitutes a strong and modern cipher suite, not a weak one.

AES-GCM (Galois/Counter Mode) is an authenticated encryption with associated data (AEAD) mode, meaning it provides both confidentiality and data integrity/authentication, thus it is not an unauthenticated encryption method.

Even when employing robust cryptographic algorithms and protocols, security breaches frequently stem from poor implementation practices, such as misconfigurations, vulnerabilities in the application layer, inadequate key management, or other operational security failures rather than inherent weaknesses in the chosen cryptographic primitives themselves.