The technician should be most concerned about data integrity and security. If information on the local database server was changed during a file transfer to a remote server, it could indicate that unauthorized access or modifications were made to the data. It could also indicate a failure in the file transfer process, which could result in data loss or corruption. The technician should investigate the cause of the changes and take steps to prevent it from happening again in the future. Additionally, they should verify the integrity of the data and restore it from a backup if necessary to ensure that the correct and complete data is available. The technician should also take appropriate actions such as notifying the system administrator and management of the incident, and following the incident management process to minimize the damage caused by the incident.

Port security is a feature that can be configured on a switch interface to limit and identify the MAC addresses of workstations that are allowed to connect to that specific port. This can help ensure that only a specific workstation (or workstations) can connect to the interface. According to the CompTIA Network+ Study Manual, "Port security can be used to specify which MAC addresses are allowed to connect to a particular switch port. If a port security violation is detected, the switch can take a number of different actions, such as shutting down the port, sending an SNMP trap, or sending an email alert."

A VLAN (Virtual Local Area Network) is a logical grouping of network devices that share the same broadcast domain, regardless of their physical location or connection1.
VLANs can be used to segment the network into different departments, functions, or security levels, and to improve the performance, security, and manageability of the network1.
To access the resources on a VLAN, a device needs to be assigned to the same VLAN ID, either statically or dynamically, and the switch needs to be configured to support VLAN tagging and trunking12.
In this scenario, the most likely cause of the problem is that the last few salespeople were assigned to the wrong VLAN, either by mistake or by lack of available ports on the correct VLAN3.
This would explain why they can access the corporate materials on the network, which are probably shared across all VLANs, but not the sales-specific resources, which are probably restricted to the sales VLAN3.
The other options are less likely to cause the problem, as they would result in different symptoms or errors, such as:
The switch was configured with port security: Port security is a feature that limits the number of MAC addresses that can be learned on a switch port, and prevents unauthorized devices from accessing the network. If port security was the cause, the new devices would not be able to connect to the network at all, or they would trigger a security violation and shut down the port.
Newly added machines are running into DHCP conflicts: DHCP (Dynamic Host Configuration Protocol) is a protocol that assigns IP addresses and other network configuration parameters to devices automatically. A DHCP conflict occurs when two devices have the same IP address on the network, which causes connectivity issues and IP address errors. If DHCP conflicts were the cause, the new devices would not be able to access any network resources, not just the sales-specific ones.
The IPS was not configured to recognize the new users: IPS (Intrusion Prevention System) is a device or a software that monitors the network traffic and blocks or alerts on any malicious or suspicious activity. If the IPS was not configured to recognize the new users, it might flag their traffic as anomalous or unauthorized, and block or drop their packets. However, this would affect their access to all network resources, not just the sales-specific ones, and it would also generate IPS logs or alerts that could be checked by the network administrator. Reference:
1: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, pp. 279-282
2: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, pp. 283-287
3: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, p. 288
4: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 14: Network Security, pp. 581-582
5: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 11: Network Services, pp. 447-449
6: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 14: Network Security, pp. 589-590

Reference:
The session layer is where conversations between applications are established, coordinated, and terminated. It is responsible for creating, maintaining, and ending sessions between different devices or processes. The physical layer deals with the transmission of bits over a medium. The presentation layer formats and translates data for different applications. The data link layer provides reliable and error-free delivery of frames within a network.

ARP spoofing is a technique that involves sending fake ARP messages to associate an attacker's MAC address with an IP address of a legitimate device on the network. This allows the attacker to intercept, modify, or drop the traffic that is intended for the legitimate device. This is also known as an on-path attack, or a man-in-the-middle attack, because the attacker is positioned between two communicating parties and can alter or manipulate the data. ARP spoofing can be used for various malicious purposes, such as stealing sensitive information, hijacking sessions, redirecting traffic, or launching other attacks. DNS poisoning, DoS attack, and rogue access point are not directly related to ARP spoofing, although they can be used in conjunction with it or as a result of it. DNS poisoning is a technique that involves corrupting the DNS cache of a server or a client with false information, such as mapping a domain name to an IP address of an attacker's server. This can be used to redirect users to malicious websites, phishing pages, or malware downloads. DoS attack is a technique that involves overwhelming a target system or network with excessive requests or traffic, such as SYN floods, ICMP floods, or UDP floods. This can be used to degrade the performance, availability, or functionality of the target system or network. Rogue access point is a wireless access point that is installed or configured without authorization on a network. This can be used to provide unauthorized access to the network, capture network traffic, or launch other attacks. Reference:
ARP Spoofing
On-path Attack
DNS Poisoning
[DoS Attack]
[Rogue Access Point]
[Network + N10-008 practice exam]
[CompTIA N10-008 Free Certification Exam Material]