The right answers must be:

A. Users need to connect an authenticator app to their Salesforce account.
C. Users need to download and install an authenticator app on their mobile device.

A & C Option D states:
“Users need to enter a verification code from email or SMS, whichever has higher priority.”

This would typically be correct in scenarios where Salesforce uses Email/SMS-based 2FA (i.e., sending a verification code to the user via email or SMS). However, when both User Interface Logins and API Logins have 2FA enabled (as specified in the question), Salesforce primarily expects an authenticator app or a hardware security key as the second factor for API logins like Data Loader.

For API logins, Salesforce does not typically use SMS or email verification codes for 2FA. Instead, it generally requires the use of an authenticator app (such as Salesforce Authenticator) or a security key for API access, including in Data Loader.