An organization determined that each of its remote sales representatives must use a smartphone for email access. The organization provides the same centrally manageable model to each person. Which…

Dual-factor authentication secures the connection to the email server but does not protect data already downloaded and stored locally on the device if it falls into unauthorized hands.

A PIN alone without an automatic wipe policy allows unlimited or excessive guessing attempts, making resident data accessible given enough time and persistence.

Encrypted communications protect data in transit between the smartphone and the email server but do not protect data that has already been received and is stored at rest on the device.

Requiring a PIN enforces access control on the physical device, and automatic wiping after a specific number of incorrect attempts ensures that resident data is destroyed before an attacker can exhaust all PIN combinations through brute force. Together these controls protect confidentiality of locally stored data regardless of whether the attacker has physical possession of the device, which is the primary threat for mobile devices.