Administrative pages are high-value targets and require strong authentication. Multi-factor authentication (2FA or 3FA) is the best practice because it requires something you know (password) plus something you have (token) or something you are (biometric). Options A and B offer only single-factor protection which is insufficient for admin access. Option D (no lockout) is dangerous as it prevents protection against brute force attacks.