Which MFA Solution Meets Know/Are/Have Without Extra Costs?

SY0-701 By islever Editorial Last updated Aug 2, 2026

Short answer

D Mobile application-generated, one-time passcode with facial recognition

Question

A company wants to add an MFA solution for all employees who access the corporate network remotely. Log-in requirements include something you know, are, and have. The company wants a solution that does not require purchasing third-party applications or specialized hardware. Which of the following MFA solutions would best meet the company's requirements?

Smart card with PIN and password
Security questions and a one-time passcode sent via email
Voice and fingerprint verification with an SMS one-time passcode
Mobile application-generated, one-time passcode with facial recognition Correct Answer

Key Takeaways

It tests whether you recognize that modern smartphones already include native biometric scanners and free enterprise authenticator apps, satisfying the 'no purchased third-party applications' constraint while delivering stronger security than SMS-based alternatives.

This question evaluates your ability to map multi-factor authentication categories to practical, cost-effective deployments. The community consensus strongly favors mobile app-generated OTPs combined with biometrics, as they fulfill all three authentication factors using native smartphone features without requiring additional purchases.

Common mistake: Candidates frequently select SMS-based options because they misinterpret 'third-party applications' as requiring a purchase, overlooking that SMS is heavily discouraged by CompTIA due to SIM-swapping vulnerabilities and that native OS biometrics eliminate the need for extra hardware.

Expert Analysis

Core Concept: Authentication Factor Mapping

Multi-factor authentication (MFA) requires combining distinct credential categories: something you know (passwords/PINs), something you have (physical devices/tokens), and something you are (biometrics). The scenario mandates all three while explicitly prohibiting additional hardware costs or paid software licenses.

Why Option D is Correct

Option D pairs a mobile application-generated one-time passcode (OTP) with facial recognition. Modern smartphones ship with operating-system-level biometric scanners (e.g., FaceID, Windows Hello) that serve as native 'something you are' factors at no extra cost. Additionally, corporate authenticator apps are typically distributed free through enterprise portals or pre-installed, meaning they do not violate the 'no purchased third-party applications' rule. This configuration securely fulfills all three factors while aligning with CompTIA’s emphasis on scalable, budget-conscious IAM strategies.

Why Other Options Fall Short

Option A specifies a smart card, which directly contradicts the prohibition on specialized hardware.
Option B relies on security questions, which are inherently weak, easily researched, and lack a true 'something you are' component.
Option C is the primary distractor. While SMS technically requires no new app, CompTIA consistently warns against SMS-based MFA due to SIM-swapping and interception risks. The community vote distribution (59% D vs 37% C) highlights a common trap regarding 'third-party applications,' but as noted by top-voted candidates, native smartphone features and free enterprise authenticators bypass this constraint entirely while providing significantly better security posture.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When analyzing MFA scenarios, immediately map each option to the three authentication factors before evaluating cost constraints. Remember that operating-system-native biometrics and vendor-provided free authenticator apps are treated as zero-cost deployments in CompTIA’s framework, making them strictly superior to legacy methods like SMS or security questions.

Community Votes

61%

39%

61% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

Anyio 👍 6 Answered D

D. Mobile application-generated, one-time passcode with facial recognition Explanation: To meet the requirements of "something you know, are, and have" while avoiding additional costs for third-party apps or hardware: Something you know: Password or PIN. Something you have: A mobile device generating a one-time passcode. Something you are: Facial recognition (biometric verification). Option D leverages mobile devices employees already own, removing the need for specialized hardware or third-party applications while meeting the MFA criteria. Why not the other options? A: Smart cards require specialized hardware. B: Security questions are weak (easily guessed) and do not qualify as “something you are.” C: Voice verification systems often require additional infrastructure and are less practical compared to mobile solutions.
DaBulls 👍 4 Answered D

D. Mobile application-generated, one-time passcode with facial recognition Why? Something you know → The password Something you have → The mobile device with the authentication app generating a one-time passcode (OTP) Something you are → Facial recognition NOT: C. Voice verification is unreliable, and SMS OTPs are vulnerable to SIM-swapping attacks.
ProudFather 👍 3 Answered C

This option best meets the company's requirements for an MFA solution that does not require third-party applications or specialized hardware: Something you know: Password Something you are: Voice and fingerprint verification Something you have: SMS one-time passcode
Fhaddad81 👍 3 Answered D

Mobile application-generated, one-time passcode with facial recognition
HQvRuss 👍 2 Answered D

D. Mobile application-generated, one-time passcode with facial recognition Explanation: The company's MFA requirements include something you know, something you have, and something you are

Show 7 more comments

pierregates5 👍 2 Answered C

the question states "without purchasing a third party application" so D is out of the question
csamuels71 👍 2 Answered C

This is wrong nothing states something you!!!
Aces155 👍 1 Answered C

I think the answer is C. In both C and D, the something you have would have to be considered the phone you’re receiving the code on. I think D is incorrect because the question specifically says “does not require purchasing third party applications or specialized hardware.” While I use rsa and Microsoft Authenticator at work, both of which are free, i think specifically within the context of this question, D would be incorrect because it indicates the use of a third party application.
Bunaventi 👍 1 Answered D

GPT: Both CompTIA and Cisco would recommend D. Mobile application-generated, one-time passcode with facial recognition as the best MFA solution. It meets the “know, are, and have” requirements while avoiding additional hardware or third-party application costs, making it secure, practical, and cost-effective.
Danny_Note 👍 1 Answered B

B. The question specifies that the methods should include something you know and something you have. That means it can't be C or D which rely on something you are. Further, they don't want to buy extra hardware. That means option A is out because of smart cards. only B fits the description.
prabh1251 👍 1 Answered C

D is incorrect - mobile application-generated passcode, which typically requires a third-party app like Google Authenticator or Microsoft Authenticator.. C is correct - No third-party app ✔️ ✅ No extra hardware ✔️ ✅ Covers "something you know, are, and have"
Nahidwin 👍 1 Answered C

The question is written very poorly , i think its C because it says without the need for purchasing a third party application , SMS don't require an application , anyway GREAT QUSTION COMPTIA !

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide