Authentication questions become easier when you separate what kind of proof is being used from the mechanism that collects or verifies it.
For Security+ SY0-701, the core factor categories are:
- Something you know
- Something you have
- Something you are
The exam objectives separately list implementations such as biometrics, hard or soft authentication tokens, and security keys.
Fast rule: Password plus PIN is still one factor type. Password plus a possession token uses two factor types and can provide multifactor authentication.
1. The distinction at a glance
| Concept | What it describes | Examples |
|---|---|---|
| Factor | The category of evidence used to prove identity | Knowledge, possession, inherence |
| Method | The practical way authentication is performed | Password sign-in, one-time code, biometric verification, certificate authentication |
| Authenticator | The credential or device used to prove control of authentication evidence | Password secret, hardware security key, authenticator application, cryptographic key |
| MFA | Authentication that requires more than one independent factor type | Password plus security key; PIN plus fingerprint |
Security products and standards do not always use the word method in exactly the same way. On the exam, focus on the distinction the scenario is testing: factor category versus implementation.
2. Authentication factors
Something you know
This is a knowledge factor.
Examples include:
- password
- passphrase
- personal identification number (PIN)
Two separate passwords are still two pieces of knowledge. They do not become multifactor authentication just because the user typed two secrets.
Something you have
This is a possession factor.
Examples include:
- hardware token
- security key
- smart card
- phone or other registered device
- authenticator application when possession of the enrolled device is part of the proof
- cryptographic private key controlled by a device or token
The exact implementation matters. A one-time code printed on paper, a code delivered to a phone, and a cryptographic security key do not provide identical security even though the scenario may classify them under possession.
Something you are
This is an inherence factor associated with a physical characteristic of the person.
Examples include:
- fingerprint
- facial characteristic
- iris pattern
For Security+ classification questions, biometrics commonly map to something you are.
3. Methods and authenticators
A method tells you how authentication is carried out. The factor tells you what kind of evidence it relies on.
| Method or implementation | Likely factor | What proves identity |
|---|---|---|
| Password | Something you know | Knowledge of the secret |
| PIN | Something you know | Knowledge of the numeric or alphanumeric secret |
| Hardware security key | Something you have | Possession and use of the enrolled authenticator |
| Authenticator-app one-time password | Something you have | Possession of the enrolled authenticator/device |
| Fingerprint scan | Something you are | Biometric characteristic |
| Client certificate backed by a protected private key | Usually possession | Control of the private key associated with the credential |
The method can be strong or weak within the same factor category. A phishing-resistant hardware security key and a text-message one-time code can both involve possession, but they do not provide the same resistance to interception, phishing, or account takeover.
4. What makes MFA
Multifactor authentication (MFA) requires more than one independent factor type.
Examples:
- password + hardware security key → knowledge + possession
- PIN + fingerprint → knowledge + inherence
- password + authenticator-app code → knowledge + possession
These are not MFA by factor count:
- password + security question → knowledge + knowledge
- password + PIN → knowledge + knowledge
- fingerprint + face scan → inherence + inherence
A system may require two steps without providing two different factors. The number of prompts is not the deciding rule.
Two-step authentication vs. multifactor authentication
A two-step login simply means the user completes two authentication steps. MFA specifically requires different factor categories.
Many real systems use the terms casually, so the exam clue is the evidence being required.
5. Classify common examples
Example 1: Password and phone code
A user enters a password and then a time-based code generated by an enrolled authenticator application.
Factors: knowledge + possession
Result: MFA
Example 2: Password and PIN
A user enters an account password and then a separate PIN.
Factors: knowledge + knowledge
Result: two secrets, but not MFA by factor diversity
Example 3: Security key with local user verification
A user authenticates with a registered hardware security key. The key itself may also require a PIN or biometric check before it can perform the cryptographic operation.
This is where implementation details matter. The system may obtain stronger authentication by combining possession of the key with another factor used to activate it. Read the question carefully instead of assuming that every security-key login uses the same factor combination.
Example 4: Device certificate
A managed device proves control of a private key associated with a certificate.
The certificate identifies the public key relationship. The private key is what the device must control. In a factor-classification scenario, this usually maps most closely to possession.
6. Biometrics and implementation nuance
Security+ uses the familiar factor model in which a fingerprint or other biometric is something you are.
NIST digital identity guidance is more precise about implementation. Biometrics are often used to activate or unlock an authenticator rather than serving as a standalone remote authenticator by themselves.
For exam purposes:
- Factor classification: fingerprint → something you are
- Implementation reasoning: ask what authenticator is actually performing the authentication and how the biometric participates
This distinction helps when a scenario includes a device-bound cryptographic authenticator that is unlocked by a fingerprint.
7. Nearby concepts that are not factors
Single sign-on
Single sign-on (SSO) reduces repeated authentication across connected services. It does not tell you how many factor types were used during the original authentication.
SSO can be protected by MFA, but SSO itself is not an authentication factor.
Federation
Federation allows one identity provider to support authentication or identity assertions for another service or security domain.
Federation describes the trust relationship, not a factor category.
Identity proofing
Identity proofing establishes that a person is who they claim to be when an identity is enrolled or established.
Authentication later verifies that the claimant can prove control of the required authenticators.
Adaptive or risk-based signals
Location, device health, behavior, network reputation, and similar context can influence an authentication decision.
Those signals can cause a system to request stronger authentication or deny access. The published SY0-701 factor list centers on something you know, have, and are, so do not automatically treat every contextual signal as an additional MFA factor.
8. Common exam traps
Trap: two credentials always means MFA
Two passwords are still one factor type.
Trap: SSO means single-factor authentication
SSO describes how access is reused across services. The original sign-in may use one factor or several.
Trap: passwordless means no authentication
Passwordless authentication replaces the password with another method, such as a security key, passkey, certificate, or biometric-assisted authenticator.
Trap: a biometric is a password substitute in every technical sense
For Security+ factor classification, biometrics are inherence. In real implementations, a biometric may unlock or activate another authenticator rather than travel to a remote service as the credential itself.
Trap: the device is always enough to prove the user
Possession of a managed device can authenticate the device. Whether it also authenticates the user depends on the design and any additional user-verification requirement.
9. Rapid review grid
| Question clue | Think |
|---|---|
| Password, passphrase, PIN | Something you know |
| Security key, token, enrolled authenticator device | Something you have |
| Fingerprint, face, iris | Something you are |
| Password + PIN | One factor type |
| Password + hardware token | MFA |
| Two steps using the same factor category | Not MFA by factor diversity |
| One login reused across several services | SSO |
| Establish the real-world identity before account use | Identity proofing |