Security Fundamentals Practice Question 3: MFA Factor Categories

Security Fundamentals · Test 1 · question 3 of 10

Identity & Access Managementmedium

A bank is reviewing four proposed login flows for its customer portal. Which one is NOT multi-factor authentication?

Show answer and explanation

Answer:

D. A password, followed by answering the security question "What was your first pet's name?"

Multi-factor authentication requires two or more different factor types: something you know (password, PIN), something you have (phone, smart card, security key), and something you are (biometric). The number of prompts does not matter. What matters is whether the factors come from different categories.

A password and a security-question answer are both something you know (D). That is two steps of a single factor, and an attacker who phishes or guesses one secret can often get the other the same way. NIST SP 800-63B goes further and says verifiers shall not prompt subscribers to use knowledge-based authentication or security questions at all.

- A. Password (know) plus a push approval on a registered device (have) is two factors. - B. The security key (have) activated by a fingerprint (are) is a single multi-factor authenticator. NIST says MFA can be performed by one authenticator that provides more than one factor. - C. The smart card (have) plus its PIN (know) is two factors.

References: NIST CSRC Glossary: multi-factor authentication; NIST SP 800-63B: Authentication and Authenticator Management

Practice Test 1 ›

Study guides for Security Fundamentals

AWS Security Specialty: is it worth it, and what's testedAWS Security Specialty (SCS-C03): who it's worth it for, the six domains, new question types, price, and how it compares with CISSP.

Best cloud security certification in 2026: which one firstCompare the top cloud security certifications for 2026, from AWS Security Specialty, SC-500 and Google PCSE to CKS and CCSP, and the order to take them.