A Government Organization Recently Contacted Three Different Vendors to Obtain

A government organization recently contacted three different vendors to obtain cost quotes for a desktop PC refresh. The quote from one of the vendors was significantly lower than the other two and was selected for the purchase. When the PCs arrived, a technician determined some NICs had been tampered with. Which of the following MOST accurately describes the security risk presented in this situation?

A) Hardware root of trust
B) UEFI
C) Supply chain
D) TPM
E) Crypto-malware
F) ARP poisoning