SSCP Access Controls Practice Question
An organization is implementing multi-factor authentication (MFA). Which TWO of the following are examples of something you have?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smart card
Something you have includes physical tokens like smart cards and hardware tokens. Biometrics are something you are, and passwords are something you know.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Smart card
Why this is correct
A smart card is a physical artefact issued to and held by the user, making it a possession factor. The embedded chip stores credentials or keys that the reader validates, so authentication depends on having the card rather than remembering a secret or presenting a biometric.
- ✗
PIN
Why it's wrong here
A PIN is knowledge held in memory, not a physical object the user possesses, so it fails the something-you-have category. It is tempting because PINs are commonly combined with tokens in MFA, but that pairing makes the PIN the knowledge factor and the device the possession factor.
- ✗
Retina scan
Why it's wrong here
A retina scan is an inherence factor, a physical characteristic of the person, so it cannot satisfy a possession requirement. It is tempting because biometrics are frequently paired with tokens in MFA deployments, yet the correct possession examples are hardware tokens, smart cards or registered devices.
- ✓
Hardware token (e.g., YubiKey)
Why this is correct
A hardware token is a physical device the user must possess, satisfying the "something you have" factor. The YubiKey generates or stores a cryptographic secret internally, so possession of the device itself proves identity, unlike a password (knowledge) or fingerprint (inherence).
- ✗
Fingerprint
Why it's wrong here
A fingerprint is an inherence factor, a biometric trait of the individual, rather than a possession factor. It is tempting because fingerprint readers are widely deployed alongside MFA, but possession requires a tangible item such as a smart card, hardware token or enrolled device.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a common method for implementing multi-factor authentication (MFA) using something you have and something you know?
easy- A.Fingerprint and retina scan
- ✓ B.Smart card and PIN
- C.Password and security question
- D.Username and password
Why B: A smart card (something you have) combined with a PIN (something you know) satisfies the two-factor requirement using two distinct authentication factor categories. This is the classic possession-plus-knowledge MFA pairing and is widely deployed in PIV/CAC and physical access systems. The other options either use two factors from the same category or only one factor.
Variation 2. An organization is planning to implement multi-factor authentication. Which TWO of the following are valid authentication factors?
easy- A.Security question
- ✓ B.Fingerprint
- C.Password
- ✓ D.Smart card
- E.IP address
Why B: Option B (Fingerprint) is correct because a fingerprint is a biometric characteristic, which is classified as a 'something you are' authentication factor — an inherence factor. Option D (Smart card) is correct because a smart card is a physical token you possess, classified as a 'something you have' authentication factor. Together with a password (something you know), these represent distinct factor categories that satisfy MFA requirements. Option A (Security question) is not a valid standalone factor category; it is a form of knowledge-based authentication, the same category as a password, so it does not add a distinct factor. Option C (Password) is a knowledge factor ('something you know') but is not marked correct here, likely because the question seeks factors other than the most basic knowledge type. Option E (IP address) is not an authentication factor at all; it is a contextual/network attribute used in risk-based or adaptive authentication, not one of the three recognized factor types (knowledge, possession, inherence).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.