Multi-Factor Authentication: Combining Something You Have and Something You Are

Quick Answer

The correct answer is the combination of a smart card and a fingerprint. This is because multi-factor authentication requires the use of two or more distinct factor types, and a smart card represents something you have—a physical possession—while a fingerprint represents something you are—an inherent biometric trait. On the Certified Information Systems Security Professional CISSP exam, this concept tests your understanding of the three core authentication factor categories: knowledge, possession, and inherence. A common trap is confusing two factors from the same category, such as a password and a PIN, which are both something you know and do not constitute true MFA. The exam emphasizes that true MFA must combine factors from at least two different categories to enhance security. A helpful memory tip is to think of the phrase “Have and Are” as the gold standard for strong authentication: you physically hold the token, and your body provides the key.