After a merger between two companies a security analyst has been asked to ensure that the organization's systems are secured against infiltration by any former employees that were terminated during…

Monitoring VPN client access is a detective control that identifies suspicious activity after it occurs, but does not proactively prevent former employees from attempting to use existing credentials.

Reducing failed login lockout settings would make the environment less secure by allowing more failed attempts before lockout, which is counterproductive to hardening against unauthorized access.

Developing and implementing updated access control policies ensures that access rights are formally reassigned, revoked, or restructured to reflect the new organizational structure post-merger, closing policy gaps that former employees could exploit.

Reviewing invalid login attempts is a reactive monitoring measure that detects intrusion attempts after the fact rather than proactively hardening applications against former employee infiltration.

Increasing password complexity requirements improves general password security but does not address the specific threat of former employees who may already know or have stored their valid credentials.

Assessing and eliminating inactive accounts directly removes the attack surface created by dormant credentials belonging to terminated employees, preventing them from using old accounts to infiltrate systems.