What are the three possible authentication factors in two-factor authentication?

• A. Something the user knows; Something the user has
• B. Something the user knows, Something the user has, Something the user is
• C. Something the user is and the user has
• D. Something the user knows

Answer: (B)

The key idea is that authentication factors fall into three distinct categories: something you know, something you have, and something you are. Two-factor authentication pairs two of these categories to verify identity, which is why combining two different factors is safer than using one.

This option lists all three factor types—the complete set of possible factors in MFA—while still aligning with how 2FA is applied in practice (you typically use two of these categories at once). The other choices miss one or more categories, which is why they’re less complete representations of the factors used in two-factor authentication.

For context, examples include: something you know (password or PIN), something you have (security token, smart card, mobile device), and something you are (biometric like fingerprint or facial recognition).