ISC2 CC Security Principles Practice Question
An organization is implementing a new access control system. Which TWO of the following are examples of Type 3 authentication factors?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fingerprint scan
Type 3 authentication factors are based on something you are — biometric characteristics — so option D (fingerprint scan) is correct because it verifies a unique physical trait of the user, and option E (retina scan) is correct because it measures the distinct vascular pattern of the eye's retina. Both are biometric methods that cannot easily be shared or forgotten, which is the defining property of Type 3 factors. Option A (password) is wrong because it is a Type 1 factor (something you know), and option C (PIN) is also a Type 1 factor (something you know). Option B (smart card) is wrong because it is a Type 2 factor (something you have).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password
Why it's wrong here
A password is a Type 1 factor, something you know; Type 3 denotes something you are, verified through biometric characteristics such as fingerprints, retinal scans or voice patterns. A password would be correct where the question asked for Type 1 factors or for a memorised secret in multifactor authentication.
- ✗
Smart card
Why it's wrong here
A smart card is a Type 2 possession factor: you authenticate by holding the physical token. Type 3 factors verify something inherent to the person, such as a fingerprint or retina pattern. Smart cards are tempting because they often combine possession with a PIN, but the card itself remains possession, not inherence.
- ✗
PIN
Why it's wrong here
A PIN is a Type 1 factor, something you know, alongside passwords and passphrases; Type 3 covers something you are, such as fingerprints, iris patterns or facial geometry. A PIN would be correct where the question asked for Type 1 factors or for a knowledge-based component of multifactor authentication.
- ✓
Fingerprint scan
Why this is correct
A fingerprint scan is a biometric characteristic, placing it in Type 3 "something you are". It satisfies the stem's requirement for a Type 3 factor because the trait is inherent to the individual, unlike possession tokens or memorised passwords.
- ✓
Retina scan
Why this is correct
A retina scan measures an intrinsic physiological trait, classifying it as Type 3 "something you are". This inherent biometric characteristic meets the stem's requirement for a Type 3 factor, distinguishing it from knowledge-based and possession-based authentication methods.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.