ISC2 CC Security Principles Practice Question
Which TWO of the following are examples of Type 3 authentication? (Select TWO).
⚠ Common exam trap
Test-takers frequently confuse authentication factor types: many candidates mistakenly classify a one-time password token or smart card as 'something you are' because they are advanced technologies, but they are actually 'something you have' (Type 2).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retina scan
Type 3 authentication is "something you are," i.e., biometrics based on a physical or behavioral characteristic of the user. Option B, retina scan, is correct because it authenticates by measuring the unique pattern of blood vessels in the eye's retina, a physiological biometric trait. Option C, fingerprint recognition, is correct because it verifies identity from the unique ridge patterns of a finger, another physiological biometric. The other options belong to different factors: A (one-time password token) and D (smart card) are Type 2, "something you have," while E (password) is Type 1, "something you know."
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One-time password token
Why it's wrong here
A one-time password token is Type 2 authentication: possession of a hardware or software device generating codes. Type 3 requires a biometric characteristic such as a fingerprint. It is tempting because OTP tokens add strong assurance beyond passwords, but possession, not inherence, is the factor.
- ✓
Retina scan
Why this is correct
Type 3 authentication relies on something you are — a biometric trait. A retina scan measures a physiological characteristic unique to the individual, satisfying that category rather than knowledge (Type 1) or possession (Type 2).
- ✓
Fingerprint recognition
Why this is correct
Fingerprint recognition qualifies as Type 3 authentication because it verifies identity through a physical biological characteristic — something the user is — rather than knowledge or possession. This satisfies the stem's requirement for inherence-based factors, distinguishing biometrics from passwords (Type 1) and tokens (Type 2).
- ✗
Smart card
Why it's wrong here
Smart cards are Type 2 authentication — something you have — not Type 3, which requires something you are, such as a fingerprint or iris scan. It is tempting because smart cards combine possession with a PIN, but the card itself remains a possession factor; biometrics alone satisfy Type 3.
- ✗
Password
Why it's wrong here
A password is Type 1 authentication — something you know — not Type 3, which requires something you are, such as a fingerprint or retina pattern. It is tempting because passwords are the most familiar credential, but knowledge is the factor being verified, not a biometric trait.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Facial Recognition Technology
Facial recognition technology is a biometric security method that identifies or verifies a person by analyzing and comparing patterns of their facial features.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.