Should be (B) VDI. The critical factor is "...while ensuring these applications are only installed on company-controlled equipment" -- this can only be assured if (1) app is accessible via virtual desktop link or (2) are virtualize apps (sessions) via VDI technology. In either case, the user can customize her/his work environment, with exception of the specified business apps. In the case of VPN, the app is either accessible via either of two means: (1) VDI/Vapp or (2) is installed locally on the user's equipment. First option leads us back to (B) VDI as correct answer; second violates premise of "company-controlled equipment", since the scenario provided does not indicate company-provided user equipment, and we cannot simply assume as much.

Should be VDI, B.

Although VDI would work, its less common because of its expense and VPN suffices the requirement at a much affordable option. I think that is why they are saying VPN.