Both Push notifications and Open Authentication (OATH) typically require a separate physical device, such as a smartphone, and a specific application installed on it. For Push, an application like PingID receives a notification to approve or deny a login attempt. For OATH (specifically TOTP/HOTP), an authenticator application (e.g., PingID, Google Authenticator) on the device generates a one-time passcode. Both methods fulfill the dual requirement of a separate device and a dedicated application.

A. Push, WebAuthn: WebAuthn does not always require a separate device; it supports platform authenticators (e.g., Windows Hello, Touch ID) built into the primary device.

B. Push, WebAuthn, Open Authentication: This option is incorrect because WebAuthn does not strictly meet the criteria, as explained above.

C. WebAuthn, Open Authentication: This option is incorrect because WebAuthn can use same-device platform authenticators, thus not requiring a separate device.

1. Ping Identity Documentation, PingID, "PingID authentication methods". This documentation describes Push notifications as requiring the PingID mobile app on a paired device. It also describes OATH TOTP support via the same app or other third-party authenticator apps.

2. Ping Identity Documentation, PingID, "FIDO2 authenticators". This source explains that WebAuthn (part of FIDO2) supports both roaming authenticators (separate devices like security keys) and platform authenticators (built into the user's computer or phone).