Given the findings, which of the following should the consultant recommend be implemented?

A consultant is performing a social engineering attack against a client. The consultant was able to collect a number of usernames and passwords using a phishing campaign. The consultant is given credentials to log on to various employees email accounts.

Given the findings, which of the following should the consultant recommend be implemented?
A . Strong password policy
B . Password encryption
C . Email system hardening
D . Two-factor authentication

Answer: D