Which of these is a tactic to extract information that eases a hacker's attack

$($A$)$ Users not changing default passwords.

Allowing employees internet access from their workstations.

Companies using the same standards for email addresses.

Manufacturers neglecting patches to operating systems.

Question?