The AI recommends choosing option C (2-factor authentication).
The question describes a scenario where a user needs to enter a username, a password, and a code sent to an authentication app. This aligns with the definition of two-factor authentication (2FA) or multi-factor authentication (MFA) where two different authentication factors are required to verify a user's identity.

Reasoning:

Two-Factor Authentication (2FA): This involves using two different factors to verify a user's identity. Common factors include:
- Something you know (e.g., password, PIN)
- Something you have (e.g., authentication app code, security token)
- Something you are (e.g., fingerprint, facial recognition)
In this case, the username/password combination represents "something you know," and the code from the authentication app represents "something you have." Thus it's two-factor authentication.
According to NIST, Multi-Factor Authentication (MFA) requires using two or more factors to authenticate
- “something you know” (e.g., a password or PIN);
- “something you have” (e.g., a smart card);
- “something you are” (e.g., a biometric).
NIST. Multi-Factor Authentication (MFA)

Reasons for not choosing other options:

A (3-factor authentication): While technically correct if more than 2 authentication ways are used, the scenario only describes username/password plus one-time passcode, which are only 2 factors.
B (Proactive authentication): Proactive authentication refers to methods that anticipate and prevent unauthorized access before it occurs, and it is not related to the described scenario.
D (Biometric authentication): Biometric authentication uses unique biological traits (e.g., fingerprints, facial recognition) for verification. This method isn't part of the described authentication process.
E (Mobile authentication): While the code is sent to an authentication app (likely on a mobile device), the term "mobile authentication" is too broad and doesn't accurately describe the specific process of using two distinct factors (knowledge and possession) for authentication. The code could be sent to desktop authentication app as well.

Suggested Answer: C

Citations:

NIST. Multi-Factor Authentication (MFA), https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-framework/online-learning/multi-factor-authentication