Fastest way to remember authentication factors
Think about what is actually being used to establish identity. A secret is something you know. A token or device is something you have. A physical biometric is something you are. A behavioral biometric is something you do. A location-based condition is somewhere you are.
Authentication factor comparison
| Factor | What it means | Typical examples | Main Security+ clue |
|---|---|---|---|
| Something You Know | Information memorized by the user | Password, PIN, passphrase, security question | Secret / memory |
| Something You Have | A physical item or device the user possesses | Smart card, hardware token, phone authenticator, OTP device | Possession |
| Something You Are | A physical biometric trait | Fingerprint, face, iris, retina | Biometric body trait |
| Something You Do | A behavioral biometric or repeated behavior pattern | Typing rhythm, signature pattern, gait, voice pattern | Behavior |
| Somewhere You Are | A location-based factor | GPS location, trusted network/site, geofence | Location / place |
1. Something you know
Knowledge factors are based on information the user remembers. Passwords, PINs, and passphrases are the most common examples.
Exam clue
If the credential is a secret stored in the user's memory, classify it as something you know.
2. Something you have
Possession factors rely on an item the user physically controls. Examples include smart cards, security keys, hardware tokens, and phone-based authenticator apps.
Exam clue
If the user must possess a device, card, or token, think something you have.
3. Something you are
Inherence factors identify a user through physical biometric traits. Fingerprints, facial recognition, iris scans, and retina scans are typical examples.
Exam clue
If the authentication method measures a physical characteristic of the person, think something you are.
4. Something you do and somewhere you are
Behavioral authentication looks at patterns such as keystroke dynamics, gait, signature behavior, or voice patterns. Location-based authentication uses contextual information such as GPS coordinates, network location, or a geofence.
What actually makes MFA multifactor?
Multifactor authentication requires two or more different authentication factor categories. Two prompts are not automatically MFA.
For example, a password plus a PIN still uses only the knowledge factor. A fingerprint plus a face scan still uses only the biometric factor. But a password plus a smart card combines knowledge and possession, so it is MFA.
Common CompTIA Security+ exam traps
- Password + PIN is not MFA. Both are something you know.
- Fingerprint + face scan is not MFA. Both are something you are.
- Password + smart card is MFA. It combines knowledge and possession.
- Multiple devices may still represent the same factor. A smart card and another possession token do not automatically create MFA.
- Count factor categories, not the number of prompts.
Mini Security+ scenarios
A user inserts an ATM card and then enters a PIN.
An employee logs into a laptop using only a password.
A remote employee enters a password and then supplies a code from a phone authenticator.
A user unlocks a phone using a fingerprint and a passcode.
A user provides both a password and a PIN.
A simple method for answering MFA questions
For every credential in the scenario, classify it before deciding whether MFA is present:
- Secret or memorized value? → Something you know
- Device, token, or item? → Something you have
- Physical biometric? → Something you are
- Behavior pattern? → Something you do
- Location? → Somewhere you are
Then count the number of different categories. Two or more categories indicate MFA.
Frequently asked questions
What are the main authentication factors?
Common factor categories include something you know, something you have, something you are, something you do, and somewhere you are.
Is password plus PIN MFA?
No. Both credentials belong to the something-you-know category.
Is password plus fingerprint MFA?
Yes. A password is something you know, while a fingerprint is something you are.
What is the difference between 2FA and MFA?
2FA uses exactly two different authentication factor categories. MFA is the broader term for using two or more different factor categories.