describe what measures should have been taken by the educational service and test preparation provider to avoid the security breach

Incomplete question. Here's part of the missing question;

The EducationS Review, a fictional company, is hit with a data breach that is making headlines. The Olianas-based educational service and test preparation provider inadvertently exposed files of at least 100,000 students in various parts of the country through its Web site. News of the breach was made public on Tuesday morning by a report in the local newspaper.

The files were exposed after the company switched the Internet service providers earlier this year. The sensitive information, which included personal data such as names, birth dates, ethnicities, and learning disabilities, as well as test performance, were easily accessed through a simple Web search and were available for at least seven weeks, according to the report. None of the information was password protected and was intended only to be viewed by EducationS authors.

Explanation:

It is important to note that the company did not make the information password protected, which creates a vulnerability.

Measures 1: only those with authentication password should have been allowed to access the information.

Measures 2:  prior to switching to a new internet service provider, an information risk assessment should have been done to ensure information security.