Only C is correct.
A is not correct because it's not secure. But if we have to choose a second option, I would choose A. On the exam we hope to see Web Server or Client Credentials option instead for this scenario.
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_username_password_flow.htm&type=5
B is not correct because SSO is not mentioned in the question, but if SSO did apply, it would be SAML Assertion Flow, not SAML Bearer Assertion
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5
C is correct because JWT applies for server to server. Since it's a scheduled job not initiated by a user, we assume it's server to server.
D is not correct because JWT doesn't support refresh token
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5

But the same time A isn't secure. Any help?

A & C. There is no info about SAML SSO between Rewards and SF, B can't be a correct option