The correct options are Mandate a verified mobile phone number for authentication and Require multi factor authentication as part of the reset process.

Administrators can require users to register and verify authentication methods and one common option is a phone number. When you Mandate a verified mobile phone number for authentication the phone becomes a confirmed method that can be used to prove identity during the self service password reset flow.

Administrators can also enforce additional verification steps during the reset and that is why Require multi factor authentication as part of the reset process is correct. Requiring MFA increases assurance that the person resetting the password is the account owner by forcing a second factor such as an authenticator app, SMS, or phone call.

Apply a minimum password age policy is incorrect because minimum password age is part of a password policy and not a verification requirement that administrators can force users to perform during the reset process. The SSPR controls focus on verifying identity and on password complexity rules rather than enforcing a minimum age at the moment of reset.

Require smart card authentication during reset is incorrect because smart cards are a sign in method for interactive authentication and they are not offered as a verification method in the SSPR verification options. Self service password reset relies on supported verification methods like phone, authenticator apps, email, or other registered methods.

Full AWS Practitioner Certification Question