Which of the following is the MOST effective data loss control when connecting a personally owned mobile device to the corporate email system?

Encrypting email data on the mobile device ensures that if the device is lost, stolen, or improperly accessed, the sensitive corporate information remains unreadable and protected from unauthorized disclosure, directly addressing data loss. This control specifically targets the confidentiality of data at rest on an endpoint outside corporate control.

Biometric MFA enhances authentication security, preventing unauthorized access to the email system, but it does not directly protect data already synced and stored on a lost or stolen device.

Manager approval provides an administrative control for initial access but does not prevent data loss once the device is connected and data is stored locally.

Preventing synchronization on public Wi-Fi hotspots mitigates man-in-the-middle attacks during transmission but does not protect data at rest on the device itself if the device is compromised.