Among common authentication factors, which statement correctly describes their classifications?

• A. Something you know (password), something you have (token), something you are (biometrics).
• B. Two-factor authentication uses two of the same factor.
• C. Location and behavior are the primary factors.
• D. Biometrics alone are sufficient for secure authentication.

Answer: (B)

Authentication factors fall into three classic categories: something you know (like a password), something you have (such as a token or smartphone authenticator), and something you are (biometrics). This framing is the most accurate way to describe how users prove who they are, because it groups the common methods by what kind of secret or credential they rely on.

Two-factor authentication is about combining two different kinds of proof from these categories to strengthen security. It is not about using two items of the same type; using two passwords or two tokens from the same category doesn’t give the same protective benefit as mixing categories. That’s why a statement claiming 2FA uses two of the same factor isn’t aligned with how 2FA is defined.

Location and behavior can add additional checks and context to authentication decisions, but they aren’t one of the core factor categories themselves. Biometrics, while powerful, aren’t universally sufficient on their own because biometric systems can fail, be spoofed, or raise privacy concerns; robust authentication often uses a second factor in addition to biometrics.

So the best description is the one that lists the three classic categories—something you know, something you have, and something you are—as the fundamental classification of authentication factors.