The correct answer is A.
OBJ-1.5: The BEST choice is to implement biometric identification for user logins, such as a fingerprint reader or a retina scanner. This would ensure that even if an employee could discover another employee’s username and password, they would be prevented from logging into the workstation without the employee’s finger or eye to scan. Enforcing short password retention can limit the possible damage when a password is disclosed, but it won’t prevent a login during the valid period. Security cameras may act as a deterrent or detective control, but they cannot prevent an employee from logging into the workstation as another employee. Security cameras could be used to determine who logged in after the fact, though.