A company would like to implement multifactor authentication for all employees at a minimal cost. Which of the following best meets the company's requirements?

Biometrics, such as fingerprint or facial recognition, often require specialized hardware (scanners, advanced cameras) for reliable implementation across an organization, incurring significant costs.

Soft tokens are software-based authenticators, typically installed as an application on a smartphone or computer, which generate a one-time password (OTP). Since most employees already possess smartphones, this method provides a cost-effective MFA solution by avoiding the purchase of specialized hardware tokens or biometric scanners.

Access control lists (ACLs) define permissions for resources and are a method of authorization, not a form of multifactor authentication.

Smart cards are physical tokens that require specialized readers and issuance/management processes, which involve higher upfront and ongoing costs compared to soft tokens.