SSH key-based authentication is the correct, security-conscious solution because it replaces the password-based login entirely with a cryptographic key pair — the external data warehouse system authenticates using its private key rather than a password subject to the 90-day expiration policy, eliminating the recurring maintenance burden of updating the file transfer script every time a password rotates, while actually strengthening security compared to password authentication rather than compromising it. This is precisely why Salesforce documents SSH Key Management as the recommended approach for unattended, script-driven, recurring file transfer integrations that need to avoid password-expiration disruption. Option A, disabling password expiration entirely for FTP users, directly conflicts with the explicit requirement that the customer does ' not want to compromise security ' — permanently exempting an account from password rotation policy is a security downgrade, not a secure workaround. Option B, enabling SAML Single Sign-On, is designed for interactive human user authentication into the Marketing Cloud application interface, not for unattended, script-based SFTP file transfer authentication. Option D is a non-solution — the scenario already specifies an Enhanced FTP account, which uses SFTP protocol; simply restating ' use SFTP ' does not address the underlying password-expiration/automation problem at all. Reference: SSH Key Management, Enhanced FTP Authentication.