Kirk needs to allow system administrators to access root passwords in emergencies. What type of solution could he implement to allow them to check out passwords when needed while also tracking those checkouts and requiring the passwords to be changed after use?

Enterprise password managers provide functionality just like this, allowing passwords to be stored securely and tracked on use. EAP is an authentication protocol; multifactor authentication adds one or more factors, increasing security, but doesn’t provide the functionality described; and passwordless isn’t designed for a checkout and reset function.