A security administrator wishes to enable multifactor authentication. Which of the following would achieve that objective? (Choose two.)

Both a security token and a dongle are possession factors (something you have), representing only a single factor category and therefore not constituting true MFA.

A fingerprint is a biometric factor (something you are) and a one-time passcode is a possession factor (something you have), combining two different factor categories and satisfying the MFA requirement.

A username is an identifier rather than an authentication factor, and challenge questions are knowledge-based, so this combination does not span multiple factor types.

A password and a PIN are both knowledge factors (something you know), meaning only one factor category is used and this remains single-factor authentication.

Voice pattern and retina scan are both biometric factors (something you are), representing only one factor category and not qualifying as MFA.

A random number generator device such as a hardware token is a possession factor (something you have) and a passphrase is a knowledge factor (something you know), again spanning two distinct factor categories and meeting the MFA definition.