What is the security risk of implementing password hashing using SHA-256 without a salt?

• A.SHA-256 without salt is vulnerable to rainbow table attacks (precomputed hash databases covering millions of common passwords), and identical passwords produce identical hashes (allowing an attacker to see that multiple users share a password by seeing the same hash). A salt (random unique value per user) ensures identical passwords produce different hashes, defeating rainbow tables
• B.SHA-256 without salt is acceptable for password storage as long as it is iterated 100,000 times
• C.SHA-256 without salt is secure because SHA-256 is a one-way function; reversing it is computationally impossible
• D.The lack of salt only matters if the attacker can see multiple hashed passwords simultaneously