How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when NOT connected to an internal company network?

A. Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.
B. Add the company’s list of network IP addresses to the Login Range list under 2FA Setup.

C. Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.

D. Use an Apex Trigger on the UserLogin object to detect the user’s IP address and prompt for 2FA if needed.