Correct answers A & C
Option A is CORRECT because Google authenticator is a time-based one-time (TOTP) password service. More details: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-totp.html
Option B is incorrect because Cognito identity pool is used to provide credentials to users in a user pool in Cognito. More details: https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html
Option C is CORRECT because you can set up Cognito to send an authentication code via SMS after you submit your correct credentials. More details: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-sms-text-message.html
Option D is incorrect because SES is a service used to send emails. More details: https://aws.amazon.com/ses/