easyMultiple Select
CISSP Practice Question: Which TWO are examples of 'something you know'…
Which TWO are examples of 'something you know' authentication factors?
⚠ Common exam trap
ISC2 often tests the distinction between authentication factor categories, and the trap here is confusing a smart card (possession) or biometric (inherence) with a knowledge factor because they may involve a PIN or password entry step, but the factor type is defined by the primary source of the secret.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PIN
A PIN is a classic 'something you know' factor because it is a memorized numeric secret the user provides to authenticate, making option A correct. A security question answer is likewise knowledge-based: the user recalls a fact or personal detail previously registered, so option B is correct. The remaining options are not knowledge factors: a retina scan (C) and a fingerprint (D) are 'something you are' biometric factors, and a smart card (E) is a 'something you have' possession factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PIN
Why this is correct
A Personal Identification Number (PIN) is a classic example of "something you know" authentication. It is a secret numerical code that a user memorizes and provides to verify their identity. The system validates the entered PIN against a stored value, confirming the user's knowledge of this specific piece of information. This knowledge-based factor relies entirely on the user's memory and the confidentiality of the secret.
- ✓
Security question answer
Why this is correct
A security question answer, such as "What was your mother's maiden name?" or "What is the name of your first pet?", falls under the "something you know" authentication factor. These are pre-defined questions whose answers are known only to the legitimate user and are used to verify identity, often for account recovery or secondary authentication. The system checks if the provided answer matches the previously stored, expected response.
- ✗
Retina scan
Why it's wrong here
A retina scan is a sophisticated biometric authentication method that analyzes the unique pattern of blood vessels on the back of a person's eye. This method falls under the "something you are" authentication factor, as it relies on inherent physical characteristics of an individual. It is not "something you know" because the user does not memorize or input this information; rather, it is measured and verified by a specialized scanner.
- ✗
Fingerprint
Why it's wrong here
Fingerprint authentication utilizes the unique ridge patterns on a person's fingertips to verify identity. This is a prime example of "something you are" authentication, leveraging an immutable biological trait. Users do not "know" their fingerprint in the sense of memorizing data; instead, their physical print is scanned and compared against a stored template. Therefore, it does not qualify as a knowledge-based factor.
- ✗
Smart card
Why it's wrong here
A smart card represents "something you have" authentication, as it is a physical token that the user possesses. These cards typically contain an embedded microchip that stores credentials or cryptographic keys, which are used to authenticate the holder. While a smart card might be combined with a PIN (something you know), the card itself, as a physical object, is fundamentally a possession factor, not a knowledge factor.
Go deeper
Related to this question
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.