The router was beaconing to a malicious site. This is a sign of root kit like malware messing up the newly installed router. This is a tell-tale sign of a counterfeit product.

First time I am guessing and don't have more concrete proof of answer since this is so vague of a scenario. Answer D) The network administrator failed to update the router’s firmware. It is highly unlikely that a SOC will buy equipment from unauthorized channels, but they still may get some counterfeit equipment from a trusted seller as they may not know they were counterfeit to begin with. Ultimately, the admin didn't update the firmware first. (ACL doesn't matter at this level because it can get bypassed by firmware level). If they tried to update it, then they would most likely have noticed a problem. https://www.technewsworld.com/story/beware-of-counterfeit-network-equipment-86770.html#:~:text=The%20counterfeits https://www.cisa.gov/sites/default/files/2023-04/apt28-exploits-known-vulnerability-to-carry-out-reconnaissance-and-deploy-malware-on-cisco-routers-uk.pdf

Definitely C