An Organization Discovers That Unauthorized Applications Have Been Installed on Company-Provided

An organization discovers that unauthorized applications have been installed on company-provided mobile phones. The organization issues these devices, but some users have managed to bypass the security controls. Which of the following is the MOST likely issue, and how can the organization BEST prevent this from happening?

A) The mobile phones are being infected with malware that covertly installs the applications. Implement full disk encryption and integrity-checking software.
B) Some advanced users are jailbreaking the OS and bypassing the controls. Implement an MDM solution to control access to company resources.
C) The mobile phones have been compromised by an APT and can no longer be trusted. Scan the devices for the unauthorized software, recall any compromised devices, and issue completely new ones.
D) Some advanced users are upgrading the devices' OS and installing the applications. The organization should create an AUP that prohibits this activity.