Cloud Kicks wants to implement multi-factor authentication (MFA) to help better secure its Salesforce org. Which two options should the administrator…

To implement Multi-Factor Authentication (MFA), an administrator needs to configure verification methods that users provide in addition to their username and password. An authentication app, such as Salesforce Authenticator or Google Authenticator, is a primary and recommended verification method. These apps generate temporary codes (TOTP) on a mobile device, which serves as the second factor ("something you have") for a user to prove their identity. Salesforce strongly supports the use of authenticator apps for MFA.
Note: This question asks for two options, but only one is a valid MFA verification method. Option C, "A Security Token," typically refers to the API security token in Salesforce, which is not used for UI MFA. The correct term for a physical MFA device is a "Security Key." Assuming "Security Token" is an error for "Security Key," it would also be a correct answer. However, as written, only A is correct.

B. A Username and Password: This is the first factor of authentication, not a method for multi-factor authentication which requires an additional verification step.
C. A Security Token: In Salesforce, this refers to a code for API/data loader access from untrusted networks, not a verification method for user interface MFA.
D. An Encryption Key: This is used for data protection (encryption at rest) and is unrelated to user authentication or identity verification processes.

1. Salesforce Help. (2023). Verification Methods for Multi-Factor Authentication. Salesforce. Retrieved from https://help.salesforce.com/s/articleView?id=sf.securitymfaverificationmethods.htm&type=5. (This document lists "Salesforce Authenticator," "Third-Party Authenticator Apps," and "Security Keys" as the primary verification methods, confirming Option A.)

2. Salesforce Trust. (2023). Multi-Factor Authentication (MFA) FAQ. Salesforce. Retrieved from https://help.salesforce.com/s/articleView?id=000352937&type=1. (The FAQ clarifies what constitutes an MFA verification method, distinguishing it from single-factor methods like username/password.)