CompTIA Security+ (SY0-701)Security OperationsEasy
A company requires VPN users to enter a password and then approve a push notification sent to their registered smartphone before a session is established. Which two authentication factors are being combined?
- ASomething you know and something you have
- BSomething you have and something you are
- CSomething you know and something you are
- DTwo separate instances of something you know
Show answer & explanationAnswer & explanation
Correct answer: A. Something you know and something you have
The password represents something the user knows, and the smartphone receiving the push notification represents something the user possesses. Combining these two distinct factor categories satisfies true multifactor authentication.
Why the other options are wrong
- B. No biometric factor is involved; the first factor is a password, not a physical trait.
- C. No biometric (inherence) factor is used in this scenario.
- D. Using two knowledge factors would not qualify as true MFA and doesn't match the scenario.
Authentication Factors
Categories of evidence used to verify identity, combined to strengthen authentication beyond a single method.
- Knowledge = password/PIN
- Possession = token/phone/smart card
- Inherence = biometric trait
- True MFA requires factors from different categories
Memory trick: Know it, Have it, Are it — mix two to lock it tight