To protect users on mobile devices from potential account compromise when accessing their corporate email, which of the following should be implemented? (Choose two.)

Single sign-on (SSO) simplifies user access but does not inherently protect against account compromise; it can even consolidate risk if the SSO mechanism itself is compromised.

Steganography is the practice of concealing a file or message within another, and is not a direct measure to protect against account compromise for email access.

Information rights management (IRM) protects the content of emails and documents from unauthorized access or sharing once they are opened, but it does not prevent the user account from being compromised.

A device lock with a PIN, pattern, or biometric ensures that even if a mobile device is lost or stolen, unauthorized users cannot easily access the device and the corporate email client installed on it, protecting against direct access to data.

Data masking is used to obscure sensitive data for non-production environments or specific views, not to protect user accounts from compromise on mobile devices.

Device tracking allows locating a lost or stolen device but does not prevent account compromise or unauthorized access to corporate email if the device is unlocked.

Two-factor authentication (2FA) adds an extra layer of security by requiring a second verification method beyond just a password, significantly reducing the risk of account compromise even if a password is stolen or guessed.