Answer is C.
This is a three-overlapping-sets Data Sufficiency problem. The real question being asked: is {Data Privacy & First Aid only} > 0?
Set up the basics first:
Total = Exactly-1 + Exactly-2 + Exactly-3
124 = 40 + Exactly-2 + Exactly-3
So Exactly-2 + Exactly-3 = 84
The Exactly-2 bucket splits into three regions:
a = Safety & Data Privacy only
b = Safety & First Aid only
c = Data Privacy & First Aid only (this is what we need)
So a + b + c + Exactly-3 = 84.
Statement (1) alone: Exactly-3 = 16, so a + b + c = 68. But we have no idea how that 68 splits between a, b, and c. c could be anywhere from 0 to 68. INSUFFICIENT.
Statement (2) alone: a + b = 27. So c + Exactly-3 = 57. But without knowing Exactly-3, c is still free to vary. INSUFFICIENT.
Together: From (1), Exactly-3 = 16 and a + b + c = 68. From (2), a + b = 27. So c = 68 - 27 = 41. Since 41 > 0, yes, at least one employee completed Data Privacy and First Aid but not Safety. SUFFICIENT.
Answer: C
The trap is thinking Statement (1) is enough. It pins down the all-three count, but the "exactly two" group still has three unknown pieces. You need (2) to split that bucket further.