Which two authentication methods should you choose?

A company has client computers that run Windows 8.
The company implements the following security requirements:
All client computers must use two-factor authentication.
At least one authentication method must include exactly four characters or gestures.
You need to choose authentication methods that comply with the security requirements.
Which two authentication methods should you choose? (Each correct answer presents part
of the solution. Choose two.)

A.
PIN

B.
Biometric authentication

C.
Picture password

D.
Microsoft account

Explanation:
Something the user knows: PIN (4 digits)
One might be tempted to think the photo for the picture password is something the User has.
But it is something the User knows, too:
He knows how to draw the gestures (maximum 3 gestures supported with picture

password), and it is no physical object (like a token, smart card …)
The MS Account is too something the user knows.
So the answer must be Biometric authentication.
Two-factor authentication requires the use of two of the three authentication factors:
Something the user knows (e.g., password, PIN);
Something the user has (physical Object) (e.g., ATM card, smart card); and Something the
user is (e.g., biometric characteristic, such as a fingerprint).
The factors are identified in the standards and regulations for access to U.S. Federal
Government systems.