A company is implementing a Remote Access Service (RAS) to allow employees to securely connect to the corporate network from various locations. The IT team is considering different authentication methods to ensure that only authorized users can access sensitive resources. They are evaluating the following options: a) using a combination of username/password and a one-time password (OTP) sent via SMS, b) relying solely on username/password, c) implementing a biometric authentication system without any additional security measures, and d) using a static IP address whitelist for access control. Which authentication method would provide the most robust security for remote access?