Which of the following allows a company to maintain access to encrypted resources when employee turnover is high?

A recovery agent - such as the EFS (Encrypting File System) Data Recovery Agent in Windows - holds a special certificate that allows it to decrypt files encrypted by any user in the organization. This prevents permanent data loss when a departing employee's private key is unavailable, which is especially important in environments with high employee turnover.

A Certificate Authority (CA) issues and manages digital certificates but does not itself hold the ability to decrypt user-encrypted data.

A trust model defines how and whether entities trust each other's certificates; it does not provide a mechanism for recovering access to encrypted content.

Key escrow stores copies of private keys with a third party for lawful interception or compliance, but it is not the standard PKI mechanism used to recover access to encrypted files within an organization.