Which two factors provide multifactor authentication for secure access to applications and data no matter where the users are or which devices they are on? (Choose two.)

Possession-based authentication relies on something the user physically holds, such as a hardware token, smart card, or registered mobile device, providing a verification factor that cannot be compromised by credential theft alone.

Pull-based describes a communication model where a client requests data from a server and is not a defined authentication factor category in any standard identity verification framework.

Push-based authentication sends an approval notification to the user's pre-registered device requiring active confirmation, which leverages possession of that device as a second factor and is explicitly recognized in modern MFA frameworks such as NIST SP 800-63B.

Power-based is not a recognized MFA factor in any standard security specification such as NIST SP 800-63B, FIDO2, or industry IAM frameworks.

Persona-based is not a standard MFA category; recognized factor categories are knowledge-based, possession-based, and inherence-based (biometrics), and persona does not map to any of them.