Which two options should the architect recommend to enable two-factor authentication for remote users? (Choose two.)