From a practical security standpoint, which statement is true?

Security must be a balance between confidentiality, integrity, and availability.

Educating users on security best practices is low priority.

System auditing should be performed only in response to breaches.

All networks should always be secured to the maximum level.

It is unnecessary to separate duties for critical functions in an organization.