GCP Professional Cloud Security Engineer Practice Question

A global manufacturer is rolling out mandatory 2-Step Verification across its Cloud Identity domain.

• Cohort 1: Production-floor operators work in shielded warehouses where personal mobile phones are banned and outbound network traffic is tightly restricted. IT can physically distribute and replace credentials but needs a phishing-resistant factor that does not rely on network connectivity during sign-in.
• Cohort 2: Field engineers carry company-managed Android and iOS phones that frequently lose data coverage yet still need to authenticate while offline. Which combination of Google-supported second factors best satisfies the security and operational requirements for Cohort 1 and Cohort 2 respectively?