A VLAN (Virtual Local Area Network) is a logical grouping of network devices that share the same broadcast domain, regardless of their physical location or connection1.
VLANs can be used to segment the network into different departments, functions, or security levels, and to improve the performance, security, and manageability of the network1.
To access the resources on a VLAN, a device needs to be assigned to the same VLAN ID, either statically or dynamically, and the switch needs to be configured to support VLAN tagging and trunking12.
In this scenario, the most likely cause of the problem is that the last few salespeople were assigned to the wrong VLAN, either by mistake or by lack of available ports on the correct VLAN3.
This would explain why they can access the corporate materials on the network, which are probably shared across all VLANs, but not the sales-specific resources, which are probably restricted to the sales VLAN3.
The other options are less likely to cause the problem, as they would result in different symptoms or errors, such as:
The switch was configured with port security: Port security is a feature that limits the number of MAC addresses that can be learned on a switch port, and prevents unauthorized devices from accessing the network. If port security was the cause, the new devices would not be able to connect to the network at all, or they would trigger a security violation and shut down the port.
Newly added machines are running into DHCP conflicts: DHCP (Dynamic Host Configuration Protocol) is a protocol that assigns IP addresses and other network configuration parameters to devices automatically. A DHCP conflict occurs when two devices have the same IP address on the network, which causes connectivity issues and IP address errors. If DHCP conflicts were the cause, the new devices would not be able to access any network resources, not just the sales-specific ones.
The IPS was not configured to recognize the new users: IPS (Intrusion Prevention System) is a device or a software that monitors the network traffic and blocks or alerts on any malicious or suspicious activity. If the IPS was not configured to recognize the new users, it might flag their traffic as anomalous or unauthorized, and block or drop their packets. However, this would affect their access to all network resources, not just the sales-specific ones, and it would also generate IPS logs or alerts that could be checked by the network administrator. Reference:
1: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, pp. 279-282
2: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, pp. 283-287
3: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 7: Virtual Networking, p. 288
4: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 14: Network Security, pp. 581-582
5: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 11: Network Services, pp. 447-449
6: CompTIA Network+ N10-008 Cert Guide, 1st Edition, Chapter 14: Network Security, pp. 589-590

A repeater is a device used to extend the range of a wireless network by receiving, amplifying, and retransmitting wireless signals. It is typically used to extend the range of a wireless network in a large area, such as an office building or a campus. Repeaters can also be used to connect multiple wireless networks together, allowing users to move seamlessly between networks. As stated in the CompTIA Network+ Study Manual, "a wireless repeater is used to extend the range of a wireless network by repeating the signal from one access point to another."

To define the location where VoIP phones can download configuration files, the network administrator can use scope options within the Dynamic Host Configuration Protocol (DHCP) service. Scope options are a set of values that can be configured within a DHCP scope, which defines a range of IP addresses that can be leased to clients on a network. One of the scope options that can be configured is the option for the location of the configuration file server, which specifies the URL or IP address of the server where the configuration files can be downloaded.
https://pbxbook.com/voip/dhcpcfg.html

A 110 block is a type of punch-down block that is used to terminate twisted-pair cables in Ethernet networks. It is a non-proprietary standard that is widely used in structured cabling systems for voice and data applications. A 110 block can support up to 100 MHz of bandwidth and can be used with Cat 3, Cat 5, Cat 5e, and Cat 6 cables12.
A 66 block is another type of punch-down block that is mainly used for telephone wiring. It is an older and less reliable standard than the 110 block and does not support high-speed data transmission3. A BiX block is a proprietary punch-down block that is developed by NORDX/CDT and is mostly used in Canada. It can support up to 250 MHz of bandwidth and can be used with Cat 5e and Cat 6 cables4. A Krone block is another proprietary punch-down block that is developed by ADC Krone and is mostly used in Europe. It can support up to 100 MHz of bandwidth and can be used with Cat 5 and Cat 5e cables.
Therefore, the best option for the customer who wants to use non-proprietary standards is the 110 block.

802.1X is an authentication component that must be used in a network access control (NAC) solution. NAC is a method of enforcing security policies on devices that want to access a network, by verifying their identity, compliance, and authorization. 802.1X is a standard that defines how to provide authentication for devices trying to connect to a LAN or WLAN. It uses the Extensible Authentication Protocol (EAP) to exchange authentication information between the device (supplicant), the network access device (authenticator), and the authentication server (typically RADIUS or TACACS+). 802.1X can prevent unauthorized devices from accessing the network, and can also assign them to different VLANs or apply different policies based on their role or group.
IPSec is a protocol suite that provides encryption, authentication, and integrity for IP packets. It can be used to create secure VPN tunnels between networks or hosts. IPSec is not an authentication component for NAC, but rather a security component for protecting data in transit.
EAP is a framework that supports multiple authentication methods, such as passwords, certificates, tokens, or biometrics. EAP is used by 802.1X to provide authentication for network access, but it is not a component by itself. EAP requires a carrier protocol, such as 802.1X, to transport the authentication messages.
TACACS+ is a protocol that provides authentication, authorization, and accounting (AAA) services for network devices or users. It can be used as an authentication server for 802.1X, but it is not an authentication component for NAC by itself. TACACS+ requires a client-server protocol, such as 802.1X, to communicate with the network access device.
Reference
What is 802.1X Network Access Control (NAC)?
Compare TACACS + and RADIUS
802.1X: What EXACTLY is it regarding WPA and EAP?
CompTIA Network+ Certification All-in-One Exam Guide, Eighth Edition (Exam N10-008)