What should the developer do in order to ensure that customer accounts cannot be accessed even if the customer's password has been compromised?

What should the developer do in order to ensure that customer accounts cannot be accessed even if the customer’s password has been compromised?

An IoT developer discovers that clients frequently fall victim to phishing attacks.

What should the developer do in order to ensure that customer accounts cannot be accessed even if the customer’s password has been compromised?
A . Implement two-factor authentication (2FA)
B. Enable Kerberos authentication
C. Implement account lockout policies
D. Implement Secure Lightweight Directory Access Protocol (LDAPS)

Answer: A