ITPEC FE Subject A April 2026 Question 28

Password plus a one-time code from a smartphone app — it combines two different factors: something you know and something you have.

Authentication factors fall into three categories:

• •Knowledge — something you know: password, PIN, answer to a security question
• •Possession — something you have: smartphone, hardware token, IC card
• •Inherence — something you are: fingerprint, face, iris, vein pattern

The password is knowledge, and the code generated on the phone proves possession of that phone, so the combination spans two categories.

Answer (c)

Why not others:

• •(a) — a security answer and another thing the user knows are both knowledge: two steps, but one factor
• •(b) — a fingerprint plus other biometrics are all inherence, again a single factor
• •(d) — the username only identifies the account; the password is the one factor that authenticates

Key rule: Count categories, not items: evidence of the same kind is still single-factor, because one kind of attack defeats all of it.

Security · AI-written, may contain errors