A cloud administrator is required to implement an MFA solution using soft tokens. Which of the following should the administrator implement to meet this requirement? (Choose two.)

A system-generated call uses a user's phone, which acts as a "soft" authenticator to receive and confirm the authentication request, making it a software-driven factor on a personal device.

A software-based RSA token (like an RSA SecurID Software Token application) generates one-time passwords on a user's personal device, perfectly fitting the definition of a soft token.

While SMS uses a phone for authentication, it is often considered less secure due to vulnerabilities like SIM swapping, and "soft token" typically refers more to app-generated OTPs than received messages.

RFID is a proximity-based identification technology primarily used for physical access control and is not an MFA soft token.

Biometrics are an authentication factor based on "something you are," rather than a "token" that generates codes or receives authentication prompts.