Exam 1Y0-402 topic 1 question 11 discussion

Scenario: A Citrix Architect needs to design a new XenApp and XenDesktop environment.
The architect has identified the User Layer requirements, as shown in the Exhibit.
Click the Exhibit button to view the requirements.

Additionally, management at the organization has identified the following general Access Layer requirements:
✑ A multi-factor authentication method is required for any connections to the XenApp and XenDesktop environment originating from outside the corporate network.
✑ External connections must be authenticated by a NetScaler Gateway virtual server located in a DMZ network.
✑ Internal connection traffic should NOT leave the internal corporate network.
Which two authentication methods should the architect use for the Contractors group? (Choose two.)