Which statement is true regarding why one-time password-generating tokens can be considered two-factor authentication mechanisms?

a.

The user may have to authenticate to the token device with a PIN before it will generate a one-time password. This is something a user knows (PIN) and something the user has (token device)

b.

The user may have to authenticate to two separate systems using her username, which is two-factor because the user has to enter something she knows two separate times.

c.

The user may have to have the token and authenticate to the workstation during an authentication process, which is two-factor because these are two things the user must possess.

d.

The user may have to authenticate to the system using her username and PIN, which is two-factor because these are two things the user knows.