An organization has adopted a bring-your-own-device (BYOD) policy, and employees can access organizational data via...

The question asks specifically about an authentication policy requirement. The strongest authentication option listed is a passcode followed by a verification response, because this represents multi-factor or two-step authentication. It requires more than a single device passcode and reduces the risk that a stolen or compromised device can access organizational data. A VPN protects communications but is not itself the best authentication requirement. An eight-digit passcode or complicated swipe pattern is only a single authentication factor. Remote wipe and encryption are important mobile security controls, but they are not authentication requirements. Internal auditors reviewing BYOD should distinguish authentication, encryption, remote wipe, device management, and network security. For authentication, Option D is correct.