Most Common MFA Authentication Factors
Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD
Answer
Correct answer: A, D — Knowledge and Biometric factors are the two most commonly used authentication factors in multifactor authentication.
What are the two most commonly used authentication factors in multifactor authentication? (Choose two.)
Community Insight
Tests understanding of MFA factor categories, specifically distinguishing between common implementations (knowledge/biometric) and non-standard options like 'time' or 'encryption'.
Identifies knowledge and biometric factors as the two most commonly used authentication methods in multifactor authentication (MFA). This page explains why these are preferred over other theoretical categories.
Learners often confuse 'possession' with 'biometric' or incorrectly select 'time factor' due to its association with TOTP tokens, overlooking that possession is a broader category while time is a specific mechanism.
Community Discussion (43 comments)
XBfoundX
👍 1
Selected: AD
We need to select A and D as specified in the following documentation in Cisco Duo: What is multi-factor authentication (MFA)? Multi-factor authentication (MFA) is a security method that requires users to verify their identity with two or more independent forms of evidence before access is granted. These forms of evidence, called authentication factors, fall into three categories: something the user knows (such as a password or PIN), something the user has (such as a smartphone or security key), and something the user is (such as a fingerprint or face scan). https://www.cisco.com/site/us/en/learn/topics/security/what-is-multi-factor-authentication-mfa.html
RemiK
👍 1
Selected: AD
agree with A & D
SegaMasterSystemAdmin
👍 1
Selected: AD
A and D are correct. B is not correct, time is not a factor in MFA
bobie
👍 1
Selected: AD
I'll go for biometric and knowledge factor : Something you know - (Knowledge - password) Something you have - (No choices) Something you are - (Biometric - fingerprint scanning or facial recognition or voice biometry)
stalkr3
👍 1
people please stop voting for answer A - how many times have you used 2FA that relies on biometric data?
nep1019
👍 2
Every. Single. Day.
SegaMasterSystemAdmin
👍 2
Go hit the books kiddo
Jessie45785
👍 1
Daily, and not only biometric but live GPS position as well - time based tokens are so outdated
Jessie45785
👍 1
Selected: AD
B- is not a factor - we can have time based hashed function but it is not a factor - in this case it would be possession factor which is not listed
stalkr3
👍 2
it IS a factor, hence the inherent security of using OTPs that expire after a very short time. And it is used very frequently, so B should be correct
Emlia1
👍 1
Selected: BD
BD - should be the correct answer
Jessie45785
👍 1
B- is not a factor - you can have time based hashed function but it is not a factor - in this case it would be possession factor listed not time
NikoNiko
👍 11
"Authentication credentials are called factors. There are three categories of factors: • Knowledge (something the user knows) --> authentication by knowledge would be a user providing a password, a personal identification number (PIN) code, or answering security questions. • Possession (something a user has) --> authentication by ownership or possession include the following: a one-time passcode, memory card, smartcard, and out-of-band communication. The most common of the four is the one-time passcode sent to a device in the user’s possession. • Inherence (something the user is)" --> authentication by characteristic authenticates the user based on some physical or behavioral characteristic, sometimes referred to as a biometric attribute. The most used physical or physiological characteristics are as follows: • Fingerprints • Face recognition • Retina and iris • Palm and hand geometry • Blood and vascular information • Voice recognition CCNP / CCIE SCOR official cert guide by Omar Santos
NikoNiko
👍 1
Currently: "Duo Push is our most commonly-used second factor of authentication, thanks to its simplicity and reliability. Users just download the Duo Mobile app and are automatically prompted to confirm each login attempt " --> Questio: Push is knowledge-based or time-based or both? - I think both. https://duo.com/product/multi-factor-authentication-mfa/authentication-methods/tokens-and-passcodes 2019 DUO: "Passcodes. Passcodes are the most common form of 2FA, and usually consist of a short string of numbers sent to a smartphone. Passcodes definitely count as 2FA. Since they rely on phone lines, however — which can be compromised — they represent the least secure method. Passcodes aren’t a real hit with users, either: each code must be manually entered, which can be a nuisance" https://duo.com/blog/two-factor-authentication-the-basics
NikoNiko
👍 1
UPDATE: Push / one-time passcode is POSSESSION BASED (something a user has), but also time-based according to Cisco DUO: " Time-Based One-Time Passcodes Some websites and online services let users protect their accounts with a mobile-generated passcode that must be manually entered and only works for a certain amount of time — typically 30-60 seconds. Duo Mobile can generate these time-based one-time passcodes (TOTP) for all third-party sites, letting users keep all of their accounts in one app." https://duo.com/product/multi-factor-authentication-mfa/authentication-methods/tokens-and-passcodes
nomanlands
👍 1
Selected: BD
D is a given. This page mentions Time-based is currently widely used while biometric is still up and coming. https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~methods
Thusi26
👍 1
A, B and D all are good according to Cisco. From Cisco Site: Knowledge Knowledge--usually a password--is the most commonly used tool in MFA solutions. However, despite their simplicity, passwords have become a security problem and slow down productivity. Inherent This category includes biometrics like fingerprint, face, and retina scans. And...... Location-based and time-based Authentication systems can use GPS coordinates, network parameters, and metadata for the network in use, and device recognition for MFA. Adaptive authentication combines these data points with historical or contextual user data. Cisco needs to get their stuff together...
pohqinan
👍 1
Reference: https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html The two most popular authentication factors are knowledge and inherent (including biometrics like fingerprint, face, and retina scans. Biometrics is used commonly in mobile devices). A and D is correct
Sun2sun
👍 1
Selected: BD
Its B and D. time factor , knowledge factor
lurker8000
👍 4
I'd go with AD here, here's a reference where "Biometric Factor" is mentioned on a cisco documentation: https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~how-mfa-works. D is a no brainer in my mind, that's the most common, although not the most secure...
coentror
👍 1
There not much here. A and D are the correct one. Do no complicate what is easy. :)
coentror
👍 1
Sorry B and D are correct.
MoII
👍 1
Agree with B and D
jaciro11
👍 2
Ey people stop discuss it Its B and D. https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html
abdulmalik_mail
👍 1
AD, on that URL writted, inherent... This category includes biometrics like fingerprint, face, and retina scans.
eazy99
👍 3
Something you are. Something you know. Correct, A and D.
NullNull88
👍 2
Uh em, .."something you "have" something you "know".
Dinges
👍 2
Time is not a factor: OTP falls under ownership factor, according to the 350-701 official cert guide. According to the offial cert guide, Biometris IS a factor: Authentication by characteristric
Dinges
👍 4
AD is correct, according to the official cert guide: ccnp-and-ccie SCOR 350-701chapter 4 AAA and Identity management: There are three categories of factors: knowledge (something the user knows), possession (something a user has), and inherence or characteristics (something the user is). Authentication by knowledge is where the user provides a secret that is only known by him or her. An example of authentication by knowledge would be a user providing a password, a personal identification number (PIN) code, or answering security questions. Examples of authentication by ownership or possession include the following: a one-time passcode, memory card, smartcard, and out-of-band communication A system that uses authentication by characteristic authenticates the user based on some physical or behavioral characteristic, sometimes referred to as a biometric attribute. The most used physical or physiological characteristics are as follows: Fingerprints, Face recognition, Retina and iris, ... Examples of behavioral characteristics are as follows: Signature dynamic, Keystroke dynamic/pattern
hisho72
👍 2
(there are no biometric, confidentiality and encryption factors). There are (factor and example): Time(access in time range), Knowledge (password), Location (access from different locations), Possession (token), Inherence (fingerprints) factors: https://duo.com/product/multi-factor-authentication-mfa/two-factor-authentication-2fa
SirFrates24
👍 1
two most commonly use MFA has to be biometric and knowledge
statikd
👍 1
The answer is B (Time) and D (Knowledge). First of all the question asks "What are the two most COMMONLY used factors in multifactor authentication?" Knowlege for sure, and time is referring to a one-time verification code, and these are the two most common. Biometric is not common. From the Official Study Guide "Wtih multifactor authentication, accounts are protected by something you know (password) and something you have (one-time verification code provided to you)."
Seawanderer
👍 2
Biometric not common? Face-id, touch-id and all the related technologies?
trickbot
👍 1
time factor might be referring to TOTP as mentioned below by JC1418. That is where you login with your username and password, then your receive a One Time Password by SMS or email, that is Time based in that it expires in a few minutes. In my experience, the most common are knowledge (passwords and pins), then token/possesion(atm cards, credit cards, rsa token fobs, token-apps), then time-based (described above), biometrics isnt that common outside of smartphones.
Kris92
👍 2
time factor? who uses that? Cisco/DUO consider biometric under inheritance, but it's still the best answer for me
JC1418
👍 3
https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~how-mfa-works What are examples of multi-factor authentication? The most common example of MFA is the process for using an ATM at a bank. To gain access to their accounts, users must insert a bank card (a physical factor) and enter a PIN (a knowledge factor). Another familiar example is the time-based one-time password (TOTP) method, used by financial institutions and other large enterprises to secure workflows, applications, and accounts. Upon requesting login, users are asked to provide a temporary passcode that has been sent via a text message, phone call, or email.
Richview
👍 3
You are absolutely correct. Biometric falls under “Inherence Factor” B & D are the correct answers.
Richview
👍 3
The answers are A,D
FilipNel
👍 4
"Biometric Factor" is correct however it's referred to as "Inherence Factor" the 350-701 exam and it's not listed on the given options. The correct answer is B and D.
crh23
👍 1
The answer are BD https://duo.com/product/multi-factor-authentication-mfa/two-factor-authentication-2fa
FilipNel
👍 3
There's no "Biometric Factor" in the 350-701 module. It's referred to as "Inherence Factor" which is not listed on the given options. Correct answer is B & D
Cnayar
👍 1
The answer are BD check here https://searchsecurity.techtarget.com/feature/5-common-authentication-factors-to-know
Vic25H
👍 5
In fact... That post mentioned this: "Two-factor authentication (2FA) usually combines a knowledge factor with either a biometric factor or a possession factor" So I'm still thinking the answer is A&D
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question asks for the two most commonly used factors. In standard security frameworks (NIST, ISO), there are three main categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are). Biometric factors fall under Inherence. While 'Possession' is technically correct, it is not an option. Among the choices provided, Knowledge (passwords/PINs) and Biometric (fingerprint/face ID) are the distinct, widely deployed factors listed.Why the Other Options Are Wrong
Options B (time), C (confidentiality), and E (encryption) are not standard authentication factors. Time is a component of Time-based One-Time Password (TOTP) algorithms, which rely on the device itself being a 'possession' factor, not time itself. Confidentiality and encryption are security goals/mechanisms, not user authentication attributes.Community Comment Notes
The community consensus strongly supports A and D. Users cite Cisco documentation and official cert guides confirming that Knowledge and Biometric (Inherence) are the primary factors discussed. Some users initially questioned if 'Biometric' was valid terminology versus 'Inherence', but confirmed it is accepted in this context.Official Reference
Exam Strategy
When asked about MFA factors, always look for the classic triad: Know, Have, Are. If one is missing from options, choose the most specific example available (e.g., Biometric for 'Are'). Avoid selecting mechanisms (like 'Time') unless they are explicitly framed as the factor itself.
Frequently Asked Questions
Is 'Time Factor' a valid authentication factor?
No. Time is a variable used in TOTP algorithms, but the factor is the possession of the device generating the token.
Why isn't 'Possession' an option here?
It is a valid factor, but the question limits choices. Biometric (Inherence) and Knowledge are the only valid standard factors listed among the distractors.