The correct answer is Single sign on using Active Directory Federation Services ADFS.

Single sign on using Active Directory Federation Services ADFS provides a true enterprise single sign on experience because it integrates with on premises Active Directory to authenticate employees once and then issue claims or tokens for access to internal and federated cloud applications. ADFS can broker trust with cloud services using standards such as SAML and WS‑Fed and it can enforce enterprise access policies and work with multi factor mechanisms to preserve security. Note that many organizations and exam objectives now favor Azure Active Directory for cloud first scenarios, but ADFS remains a supported on premises federation and SSO solution and is the best fit for the scenario as described.

Federated identity using OAuth 2.0 is incorrect because OAuth 2.0 is primarily an authorization framework rather than an authentication or SSO protocol. Federated SSO implementations typically use SAML or OpenID Connect on top of OAuth flows to provide identity and single sign on, so the option as stated does not directly deliver the described enterprise SSO experience.

Passwordless authentication with WebAuthn is incorrect because WebAuthn describes a strong, phishing resistant authentication method for user sign in. It does not by itself provide the federation, token brokering, or application trust relationships required to implement single sign on across a range of internal and cloud services.

Multi factor authentication is incorrect because MFA is an important security control that strengthens sign in, but it is not a single sign on solution on its own. MFA complements SSO by adding verification factors, but it does not eliminate repeated credential prompts across disparate services without an identity federation or SSO broker.

Full AWS Practitioner Certification Question