An information security professional is reviewing user access controls on a customer-facing application. The application must have multi-factor authentication (...