Which of the following should be implemented to stop an attacker from mapping out addresses and/or devices on a network?

Single sign-on is an authentication mechanism that consolidates login credentials and has no effect on network enumeration or DNS record exposure.

IPv6 changes the addressing scheme but does not inherently prevent network mapping; attackers can enumerate IPv6 addresses through other means.

DNS zone transfers (AXFR queries) are designed to replicate DNS records between servers, but if misconfigured, they allow any host to request a full dump of all DNS records for a domain. An attacker can use this to map every device name and address on the network without sending a single probe packet. Restricting zone transfers to authorized secondary DNS servers closes this reconnaissance vector.

VoIP is a voice communication protocol and is entirely unrelated to preventing network address or device discovery.