CISSP Identity and Access Management Practice Question
Which authentication factor type is a smart card?
⚠ Common exam trap
It's easy for candidates to confuse 'something you have' (Type 2) with 'something you are' (Type 3) because smart cards are often used with biometric readers, but the card itself is a possession factor, not a biometric.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Type 2 (something you have)
A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Somewhere you are
Why it's wrong here
"Somewhere you are" refers to authentication based on a user's physical or logical location, often verified through GPS coordinates, IP address geolocation, or network segment identification. A smart card is a portable physical device, not a location, and its presence alone does not inherently verify the user's geographical or network position. Therefore, a smart card does not fall under this location-based authentication factor.
- ✓
Type 2 (something you have)
Why this is correct
A smart card is a quintessential example of a "something you have" authentication factor because it is a tangible, physical item that the user must possess and present for authentication. This factor relies on the physical control of an object, such as a cryptographic token, USB key, or in this case, a smart card. The card securely stores cryptographic keys or digital certificates, which are accessed only when the card is physically inserted into a compatible reader, thereby proving possession.
- ✗
Type 3 (something you are)
Why it's wrong here
"Something you are" factors, also known as biometric factors, rely on unique, inherent biological or behavioral characteristics of an individual for authentication. Examples include physiological traits like fingerprints, iris scans, or facial recognition, and behavioral traits such as gait analysis or voice recognition. A smart card is an external, manufactured device and does not represent any intrinsic biological attribute or behavior of the user, making this option incorrect.
- ✗
Type 1 (something you know)
Why it's wrong here
"Something you know" factors are knowledge-based authentication methods that rely on secret information known only to the legitimate user. This category includes common credentials like passwords, Personal Identification Numbers (PINs), or answers to security questions. While a smart card often requires a PIN (a "something you know" factor) to activate its functionality, the smart card itself is a physical object, not the memorized knowledge, thus it is not a "something you know" factor.
Go deeper
Related to this question
Learn chapter
Physical Security and Environmental Controls
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Digital certificate
A digital certificate is an electronic document that verifies the identity of a person, device, or website and enables secure encrypted communication over the internet.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.