I'm putting C on the real exam. If I fail, I fail with dignity.

Why isn't this C?

HMAC-based One-Time Password = something you have Logon creds (Username/Password) = something you know Choosing C

It has been specified here that authentication on a vpn so I think A is correct

The answer is not A, A is not secure IP (somewhere you are) can be spoofed. The answer is C, ill go for C on the exam

cant you spoof your public IP address?

To connect via VPN using two-factor authentication after set-up: Go to the URL and login with their username and password. Choose which authentication method: Duo Push, phone call, text or passcode. If they choose Duo Push, a notification will be sent to their phone. They simply have to select the “Approve” button to redirect their browser to the SSL VPN service homepage. Then they can launch “Tunnel Mode” to direct traffic through their VPN. See What are the authentication choices? for more information on how each method works. https://www.otava.com/reference/two-factor-authentication-for-vpn-login-faq/

Based on the link below both C and A are corrects: https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html

Both answers A and C look right to me. A: something you know + somewhere you are. C: something you have (to receive the HOTP) + something you know.