How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?
A . Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.
B . Add the list of company’s network IP addresses to the Login Range list under 2FA Setup.
C . Use an Apex Trigger on the User Login object to detect the user’s IP address and prompt for 2FA if needed.
D . Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

Answer: A