The correct response is employees do not use not always use complex passwords to protect their accounts. This is an easy entryway for the attacker to enter into privilege escalation attacks.

I would argue that option B "user accounts are difficult to verify" could be an answer as well. In fact, it's much more likely that someone gains escalated privileges by using or finding an unused or "forgotten about" account much more than cracking a weak password.