C. BYOD policy Bring-your-own-device (BYOD) policies are set by companies to allow employees to use their personal smartphones, laptops, and tablets for work E.MDM policy mobile device management policy establishes rules for how mobile devices are used and secured within your company.

C. BYOD policy – you can’t assume that workers will use their own equipment. It doesn’t secure the company’s assets as no one has control over what people can install on their devices while accessing corporate data. Everyone can have different phones (brands, models, OS) which complicate security. E. MDM policy – this lets you push updates, secure devices and manage them from a centralized place. The best model, in this case, is to apply the COPE or CYOD policy model. F. Time-based login policies – it will restrict people from accessing assets out of hours. I am going for E and F.

They want more control over mobile devices and they want to be secure. Also it doesn't mention that they are worried about cost. So why is C and answer here? I'd imagine a lot of user's own devices would be android-based phones compromised with malware and the like...

I would go with E, F because the company is concerned with security of such I frustructure so mdm would help manage and secure mobile devices and restricting off hours login would help secure the data that's being accessed.