An organization hosts a public facing website that contains a login page for users who are registered and authorized to access a secure, non-public section of the site. That non-public site hosts information that requires multifactor authentication for access. Which of the following access management approaches would be the best practice for the organization?

A. username/password with TOTP

B. username/password with pattern matching

C. username/password with a PIN

D. username/password with a CAPTCHA

please explain. note: this is study material for the comptia security+ exam