What is 'Multi-Factor Authentication' (MFA) and why does it substantially increase security over single-factor?

• A.MFA requires entering a password twice from two different devices; step-up authentication is a server restart that forces every session to re-authenticate simultaneously; the Digest authentication scheme salts the password with the server's certificate serial, tying credentials to the TLS session; the client_credentials grant identifies an end user through the client secret, making it suitable for browser apps
• B.MFA requires two or more distinct categories of authentication factor: something you know (password), something you have (authenticator app, hardware key), or something you are (biometrics). An attacker who steals a password still cannot authenticate without the second factor
• C.MFA is only required for admin accounts and does not improve regular user security; FIDO2 security keys transmit a shared secret established at manufacture, which the relying party stores like a password; HTTP Basic authentication encrypts credentials with the server's public key before transmission; requiring re-authentication before sensitive actions is redundant when the session is bound to the client IP address
• D.