Which two actions should UC consider to meet this requirement?

After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce.

Which two actions should UC consider to meet this requirement? Choose 2 answers
A . Require users to provide their RSA token along with their credentials.
B. Require users to supply their email and phone number, which gets validated.
C. Require users to enter a second password after the first Authentication
D. Require users to use a biometric reader as well as their password

Answer: A,D