Which one of the following approaches would be a satisfactory implementation of multifactor authentication in the case that Gary’s firm recognized that they are not currently using multifactor authentication for remote users after a recent penetration test?

A Passwords combined with smartcards

explanation