easyMultiple Select

200-201 Practice Question: A security analyst is implementing multifactor…

A security analyst is implementing multifactor authentication. Which TWO are considered factors? (Select two.)

⚠ Common exam trap

Cisco often tests the distinction between identification (user ID) and authentication (factors that prove identity), leading candidates to mistakenly select user ID as a factor when it is only an identifier.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Password

A password (A) is a knowledge factor — something the user knows — and is one of the three classic authentication factor categories (knowledge, possession, inherence), so it qualifies as a factor in MFA. An RSA token (E) is a possession factor — something the user has — generating a one-time passcode (e.g., TOTP/HOTP), which is exactly the second factor MFA combines with a password. The remaining options are not authentication factors: last login time (B) is audit/log data, a user ID (C) is an identifier rather than a verifier, and security group membership (D) is an authorization attribute, not a factor used to prove identity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Password
Why this is correct
A password is a knowledge factor: something the user knows. Multifactor authentication requires factors from different categories, so pairing it with a possession or inherence factor satisfies the two-factor requirement rather than duplicating the same category.
✗
Last login time
Why it's wrong here
Last login time is an audit and monitoring record, not a factor; it cannot prove identity because it is generated by the system after authentication. It tempts because it feeds anomaly detection and impossible-travel alerts, which is the correct answer when the question asks how suspicious sign-ins are detected.
✗
User ID
Why it's wrong here
A user ID is a claimed identifier, not a factor; it establishes who the subject says they are before any verification occurs. It tempts because it is the first field entered at sign-in, which is the correct answer when the question asks what uniquely names an account rather than what proves it.
✗
Security group membership
Why it's wrong here
Group membership is an authorisation attribute, not an authentication factor; it grants access after identity is proven. It tempts because groups drive role-based access control and least-privilege design, which is the right answer when the question asks how permissions are assigned rather than how identity is verified.
✓
RSA token
Why this is correct
An RSA token is a possession factor: something the user has. It generates time-based one-time codes, so combining it with a knowledge factor such as a password delivers genuine multifactor authentication across two distinct categories.

Quick reference

Asymmetric Encryption Algorithm Comparison

Algorithm	Key Exchange	Signatures	Equivalent Security Key	Notes
RSA-3072	Yes	Yes	128-bit	Widely deployed; slow for bulk data
ECDSA P-256	No	Yes	128-bit	Fast signatures; standard TLS certs
ECDH / ECDHE	Yes	No	128-bit	Perfect forward secrecy in TLS 1.3
DH / DHE	Yes	No	128-bit (3072-bit key)	Replaced by ECDHE in modern TLS
Ed25519	No	Yes	~128-bit	SSH keys, modern PKI

Go deeper

200-201 Practice Question: A security analyst is implementing multifactor…

Why each option matters

Option-by-option breakdown

Asymmetric Encryption Algorithm Comparison

Related to this question