A company wants to reduce the risk that a stolen password alone can compromise a user account. Which measure most directly helps?

1. Publish passwords in an internal document
2. Require multi-factor authentication
3. Use the same password for all accounts
4. Grant broader IAM roles