When does a RADIUS server send an Access-Challenge packet?

When does a RADIUS server send an Access-Challenge packet?
A . The server does not have the user credentials yet.
B . The server requires more information from the user, such as the token code for two-factor authentication.
C . The user credentials are wrong.
D . The user account is not found in the server.

Answer: B