I think A, B D, E, are all correct.

Lightning login:
https://help.salesforce.com/s/articleView?id=sf.security_ll_overview.htm&type=5

Lightning Login relies on Salesforce Authenticator (version 2 or later), the multi-factor authentication mobile app that’s available as a free download for iOS and Android devices. By requiring two factors of authentication for login, Lightning Login adds an extra layer of security.

The first factor is something that the user has—for example, a mobile device that has Salesforce Authenticator installed and connected with the user’s Salesforce account.
The second factor is something that the user is, such as a fingerprint, or something that the user knows, such as a PIN. The second level of authentication enhances security by requiring access to the mobile device and the user’s fingerprint or PIN.

SMS: https://help.salesforce.com/s/articleView?id=sf.security_mfa_sms_for_external_users.htm&type=5

Third party: https://help.salesforce.com/s/articleView?id=sf.mfa_supported_verification_methods_totp.htm&type=5

Security Key: https://help.salesforce.com/s/articleView?id=sf.mfa_supported_verification_methods_securitykey.htm&type=5...

I think A, D, E because they meet the multi-factor authentication definition.
"not only a username and password but also an additional confidential set of information that only the real user possesses"

I feel A,D,E should be the correct answer