ISC2 CC Security Principles Practice Question
A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)
⚠ Common exam trap
CC often tests the confusion between knowledge and possession factors; candidates mistakenly classify a PIN or password as 'something you have' because it's stored on a device, or mislabel biometrics as possession.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A hardware OTP token
A hardware OTP token (B) is correct because it is a physical device the user must possess, and it generates one-time passcodes, making it a classic Type 2 possession factor. A smart card (E) is also correct because it is a physical object the user holds and inserts or taps to authenticate, fitting the possession category. In contrast, a PIN (A) and a password (D) are knowledge factors (Type 1) because they rely on something the user knows, and a fingerprint (C) is an inherence factor (Type 3) because it relies on a biometric characteristic of the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A PIN
Why it's wrong here
A PIN is a Type 1 knowledge factor, something the user memorises, so it cannot satisfy the possession requirement. It tempts because PINs often accompany tokens, but the token itself, not the PIN, supplies the possession element.
- ✓
A hardware OTP token
Why this is correct
A hardware OTP token is a physical device issued to the user, so presenting its generated code demonstrates possession. That tangible-device characteristic is precisely what qualifies it as a Type 2 factor rather than knowledge or inherence.
- ✗
A fingerprint
Why it's wrong here
A fingerprint is a Type 3 (inherence) factor — a biometric trait of the user — not something the user possesses. It is tempting because biometrics are widely used for authentication, and a fingerprint is correct when the question asks for inherence factors instead of possession factors.
- ✗
A password
Why it's wrong here
A password is a Type 1 (knowledge) factor — something the user knows — so it cannot satisfy a possession requirement. It is tempting because passwords are the most common authentication method, and they are correct when the question asks for knowledge factors rather than something the user has.
- ✓
A smart card
Why this is correct
A smart card is a physical object the user must hold and insert, making it a possession factor. Knowledge of a PIN may accompany it, but the card itself satisfies the Type 2 requirement by proving control of a tangible token.
Go deeper
Related to this question
Learn chapter
Physical Access Controls
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Common Access Card
A Common Access Card (CAC) is a smart card issued by the U.S. Department of Defense that serves as a single identification, authentication, and access credential for military personnel and contractors.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.