Most Common MFA Authentication Factors

350-701 By islever Editorial Last updated

Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD

Short answer

AD Knowledge and Biometric factors are the two most commonly used authentication factors in multifactor authentication.

Question

What are the two most commonly used authentication factors in multifactor authentication? (Choose two.)
  1. biometric factor Correct Answer
  2. time factor
  3. confidentiality factor
  4. knowledge factor Correct Answer
  5. encryption factor

Key Takeaways

Tests understanding of MFA factor categories, specifically distinguishing between common implementations (knowledge/biometric) and non-standard options like 'time' or 'encryption'.

Identifies knowledge and biometric factors as the two most commonly used authentication methods in multifactor authentication (MFA). This page explains why these are preferred over other theoretical categories.

Common mistake: Learners often confuse 'possession' with 'biometric' or incorrectly select 'time factor' due to its association with TOTP tokens, overlooking that possession is a broader category while time is a specific mechanism.

Expert Analysis

Why the Answer Is Correct

The question asks for the two most commonly used factors. In standard security frameworks (NIST, ISO), there are three main categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are). Biometric factors fall under Inherence. While 'Possession' is technically correct, it is not an option. Among the choices provided, Knowledge (passwords/PINs) and Biometric (fingerprint/face ID) are the distinct, widely deployed factors listed.

Why the Other Options Are Wrong

Options B (time), C (confidentiality), and E (encryption) are not standard authentication factors. Time is a component of Time-based One-Time Password (TOTP) algorithms, which rely on the device itself being a 'possession' factor, not time itself. Confidentiality and encryption are security goals/mechanisms, not user authentication attributes.

Community Comment Notes

The community consensus strongly supports A and D. Users cite Cisco documentation and official cert guides confirming that Knowledge and Biometric (Inherence) are the primary factors discussed. Some users initially questioned if 'Biometric' was valid terminology versus 'Inherence', but confirmed it is accepted in this context.

Official Reference

https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~how-mfa-works

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about MFA factors, always look for the classic triad: Know, Have, Are. If one is missing from options, choose the most specific example available (e.g., Biometric for 'Are'). Avoid selecting mechanisms (like 'Time') unless they are explicitly framed as the factor itself.

Frequently Asked Questions

Is 'Time Factor' a valid authentication factor?

No. Time is a variable used in TOTP algorithms, but the factor is the possession of the device generating the token.

Why isn't 'Possession' an option here?

It is a valid factor, but the question limits choices. Biometric (Inherence) and Knowledge are the only valid standard factors listed among the distractors.

More 350-701 FAQ →

Discussion 43 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 43

  1. NikoNiko 👍 11
    "Authentication credentials are called factors. There are three categories of factors: • Knowledge (something the user knows) --> authentication by knowledge would be a user providing a password, a personal identification number (PIN) code, or answering security questions. • Possession (something a user has) --> authentication by ownership or possession include the following: a one-time passcode, memory card, smartcard, and out-of-band communication. The most common of the four is the one-time passcode sent to a device in the user’s possession. • Inherence (something the user is)" --> authentication by characteristic authenticates the user based on some physical or behavioral characteristic, sometimes referred to as a biometric attribute. The most used physical or physiological characteristics are as follows: • Fingerprints • Face recognition • Retina and iris • Palm and hand geometry • Blood and vascular information • Voice recognition CCNP / CCIE SCOR official cert guide by Omar Santos
  2. Vic25H 👍 5
    In fact... That post mentioned this: "Two-factor authentication (2FA) usually combines a knowledge factor with either a biometric factor or a possession factor" So I'm still thinking the answer is A&D
  3. Dinges 👍 4
    AD is correct, according to the official cert guide: ccnp-and-ccie SCOR 350-701chapter 4 AAA and Identity management: There are three categories of factors: knowledge (something the user knows), possession (something a user has), and inherence or characteristics (something the user is). Authentication by knowledge is where the user provides a secret that is only known by him or her. An example of authentication by knowledge would be a user providing a password, a personal identification number (PIN) code, or answering security questions. Examples of authentication by ownership or possession include the following: a one-time passcode, memory card, smartcard, and out-of-band communication A system that uses authentication by characteristic authenticates the user based on some physical or behavioral characteristic, sometimes referred to as a biometric attribute. The most used physical or physiological characteristics are as follows: Fingerprints, Face recognition, Retina and iris, ... Examples of behavioral characteristics are as follows: Signature dynamic, Keystroke dynamic/pattern
  4. lurker8000 👍 4
    I'd go with AD here, here's a reference where "Biometric Factor" is mentioned on a cisco documentation: https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~how-mfa-works. D is a no brainer in my mind, that's the most common, although not the most secure...
  5. FilipNel 👍 4
    "Biometric Factor" is correct however it's referred to as "Inherence Factor" the 350-701 exam and it's not listed on the given options. The correct answer is B and D.
Show 25 more comments
  1. JC1418 👍 3
    https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~how-mfa-works What are examples of multi-factor authentication? The most common example of MFA is the process for using an ATM at a bank. To gain access to their accounts, users must insert a bank card (a physical factor) and enter a PIN (a knowledge factor). Another familiar example is the time-based one-time password (TOTP) method, used by financial institutions and other large enterprises to secure workflows, applications, and accounts. Upon requesting login, users are asked to provide a temporary passcode that has been sent via a text message, phone call, or email.
  2. FilipNel 👍 3
    There's no "Biometric Factor" in the 350-701 module. It's referred to as "Inherence Factor" which is not listed on the given options. Correct answer is B & D
  3. Richview 👍 3
    You are absolutely correct. Biometric falls under “Inherence Factor” B & D are the correct answers.
  4. eazy99 👍 3
    Something you are. Something you know. Correct, A and D.
  5. Richview 👍 3
    The answers are A,D
  6. hisho72 👍 2
    (there are no biometric, confidentiality and encryption factors). There are (factor and example): Time(access in time range), Knowledge (password), Location (access from different locations), Possession (token), Inherence (fingerprints) factors: https://duo.com/product/multi-factor-authentication-mfa/two-factor-authentication-2fa
  7. Dinges 👍 2
    Time is not a factor: OTP falls under ownership factor, according to the 350-701 official cert guide. According to the offial cert guide, Biometris IS a factor: Authentication by characteristric
  8. stalkr3 👍 2
    it IS a factor, hence the inherent security of using OTPs that expire after a very short time. And it is used very frequently, so B should be correct
  9. jaciro11 👍 2
    Ey people stop discuss it Its B and D. https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html
  10. Kris92 👍 2
    time factor? who uses that? Cisco/DUO consider biometric under inheritance, but it's still the best answer for me
  11. Seawanderer 👍 2
    Biometric not common? Face-id, touch-id and all the related technologies?
  12. NullNull88 👍 2
    Uh em, .."something you "have" something you "know".
  13. SegaMasterSystemAdmin 👍 2
    Go hit the books kiddo
  14. nep1019 👍 2
    Every. Single. Day.
  15. NikoNiko 👍 1
    Currently: "Duo Push is our most commonly-used second factor of authentication, thanks to its simplicity and reliability. Users just download the Duo Mobile app and are automatically prompted to confirm each login attempt " --> Questio: Push is knowledge-based or time-based or both? - I think both. https://duo.com/product/multi-factor-authentication-mfa/authentication-methods/tokens-and-passcodes 2019 DUO: "Passcodes. Passcodes are the most common form of 2FA, and usually consist of a short string of numbers sent to a smartphone. Passcodes definitely count as 2FA. Since they rely on phone lines, however — which can be compromised — they represent the least secure method. Passcodes aren’t a real hit with users, either: each code must be manually entered, which can be a nuisance" https://duo.com/blog/two-factor-authentication-the-basics
  16. XBfoundX 👍 1
    We need to select A and D as specified in the following documentation in Cisco Duo: What is multi-factor authentication (MFA)? Multi-factor authentication (MFA) is a security method that requires users to verify their identity with two or more independent forms of evidence before access is granted. These forms of evidence, called authentication factors, fall into three categories: something the user knows (such as a password or PIN), something the user has (such as a smartphone or security key), and something the user is (such as a fingerprint or face scan). https://www.cisco.com/site/us/en/learn/topics/security/what-is-multi-factor-authentication-mfa.html
  17. Thusi26 👍 1
    A, B and D all are good according to Cisco. From Cisco Site: Knowledge Knowledge--usually a password--is the most commonly used tool in MFA solutions. However, despite their simplicity, passwords have become a security problem and slow down productivity. Inherent This category includes biometrics like fingerprint, face, and retina scans. And...... Location-based and time-based Authentication systems can use GPS coordinates, network parameters, and metadata for the network in use, and device recognition for MFA. Adaptive authentication combines these data points with historical or contextual user data. Cisco needs to get their stuff together...
  18. NikoNiko 👍 1
    UPDATE: Push / one-time passcode is POSSESSION BASED (something a user has), but also time-based according to Cisco DUO: " Time-Based One-Time Passcodes Some websites and online services let users protect their accounts with a mobile-generated passcode that must be manually entered and only works for a certain amount of time — typically 30-60 seconds. Duo Mobile can generate these time-based one-time passcodes (TOTP) for all third-party sites, letting users keep all of their accounts in one app." https://duo.com/product/multi-factor-authentication-mfa/authentication-methods/tokens-and-passcodes
  19. statikd 👍 1
    The answer is B (Time) and D (Knowledge). First of all the question asks "What are the two most COMMONLY used factors in multifactor authentication?" Knowlege for sure, and time is referring to a one-time verification code, and these are the two most common. Biometric is not common. From the Official Study Guide "Wtih multifactor authentication, accounts are protected by something you know (password) and something you have (one-time verification code provided to you)."
  20. trickbot 👍 1
    time factor might be referring to TOTP as mentioned below by JC1418. That is where you login with your username and password, then your receive a One Time Password by SMS or email, that is Time based in that it expires in a few minutes. In my experience, the most common are knowledge (passwords and pins), then token/possesion(atm cards, credit cards, rsa token fobs, token-apps), then time-based (described above), biometrics isnt that common outside of smartphones.
  21. pohqinan 👍 1
    Reference: https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html The two most popular authentication factors are knowledge and inherent (including biometrics like fingerprint, face, and retina scans. Biometrics is used commonly in mobile devices). A and D is correct
  22. bobie 👍 1
    I'll go for biometric and knowledge factor : Something you know - (Knowledge - password) Something you have - (No choices) Something you are - (Biometric - fingerprint scanning or facial recognition or voice biometry)
  23. nomanlands 👍 1
    D is a given. This page mentions Time-based is currently widely used while biometric is still up and coming. https://www.cisco.com/c/en/us/products/security/what-is-multi-factor-authentication.html#~methods
  24. Jessie45785 👍 1
    B- is not a factor - we can have time based hashed function but it is not a factor - in this case it would be possession factor which is not listed
  25. Jessie45785 👍 1
    B- is not a factor - you can have time based hashed function but it is not a factor - in this case it would be possession factor listed not time

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide