The correct answer is D - Weak passwords.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), unauthorized SSH access from an unknown IP address often suggests that the attacker exploited weak or compromised passwords to gain access. Weak passwords are a common vulnerability for services exposed to the internet, especially SSH servers.
Exfiltration (A) refers to data theft after access, not initial unauthorized access. Unpatched software (B) might lead to other vulnerabilities but is not indicated here. Enumeration (C) is gathering information but not gaining login access directly.
Reference Extract from Study Guide:
"Weak or compromised passwords are a primary cause of unauthorized access, particularly for remote management interfaces such as SSH."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication Security BestPractices