Sanitization is the process of thoroughly removing or wiping all data from devices before disposal or donation to prevent sensitive information from being recovered or leaked.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 4.4: "Sanitization is used to ensure data cannot be recovered from donated or decommissioned equipment." Exam Objectives 4.4: "Summarize business continuity and disaster recovery concepts."

Centralized authentication (such as Active Directory or LDAP) combined with proper password policies helps prevent the reuse of the same local credentials across multiple systems, reducing the risk of lateral movement during attacks like credential reuse or pass-the-hash.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 3.1: "Centralized authentication and strong password policies reduce risks associated with local account reuse." Exam Objectives 3.1: "Implement secure network architecture concepts."

A Mobile Device Management (MDM) platform protects organizational mobile devices by enforcing security policies, restricting unauthorized configuration changes, and detecting compromised devices. One of the major vulnerabilities MDM mitigates is jailbreaking, which occurs when a user removes manufacturer restrictions to gain unrestricted access to the file system and install unapproved apps.
Security+ SY0-701 explains that jailbroken devices:
Bypass built-in security protections
Are more susceptible to malware
Can be used for data exfiltration
Violate corporate mobile security policies
MDM solutions detect jailbroken or rooted devices and automatically block them from accessing corporate resources, enforce compliance rules, and remotely wipe devices if necessary.
TPM (A) is a hardware security chip unrelated to MDM. Buffer overflow (B) and SQL injection (D) are software development vulnerabilities, not mobile device policy issues.
Thus, the correct answer is C: Jailbreaking.

The best answer is A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication.
The company wants a single, integrated authentication solution that is both more secure and easier for employees to use. FIDO2 passkeys best match this requirement because they allow passwordless authentication using cryptographic credentials stored on the user's device, often unlocked with biometrics or a local PIN.
This improves security and usability because:
users no longer need to manage a password plus a separate authenticator app phishing resistance is stronger than traditional passwords and OTPs authentication is integrated into the device experience biometric unlock makes login smoother for users Why the other options are incorrect:
B). Implementing SMS-based one-time passwords as the primary second factor for all loginsSMS is weaker than modern phishing-resistant methods and still does not solve the issue of streamlining authentication as well as passkeys.
C). Implementing SAML federation across authentication servers so employees can use SSO to access applicationsSSO improves convenience, but it does not by itself replace passwords with a more secure integrated authentication method. It solves access federation, not the core password-plus-authenticator problem.
D). Deploying a PKI system that requires all employees to use smart cards for login accessSmart cards can be secure, but they are less convenient and less seamless than device-based passkeys and biometrics for many organizations.
From a SY0-701 perspective, FIDO2 and passwordless authentication are strong modern controls that improve both security and user experience. Therefore, A is the best answer.