Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires a user to present two or more different types of evidence before access is granted. The factor types are something you know (password, PIN), something you have (hardware token, authenticator app, smart card), and something you are (fingerprint, iris, face). Combining types means a stolen password alone no longer opens the account, which is why MFA is the single most effective control against credential theft and the baseline expectation for any privileged or remote login.

The counting rule decides exam answers: factors are counted by type, not by number. A password plus a PIN is two of “something you know”, so it is still single-factor authentication. A password plus a one-time code from a device you hold is genuinely two-factor. MFA also has failure modes of its own: in an MFA fatigue attack, an attacker who already holds the password bombards the user with push notifications until one is approved, which is why number-matching prompts and phishing-resistant hardware keys are preferred over simple approve-or-deny pushes.

Exam relevance: if a scenario lists two credentials of the same type, the answer is that it remains single-factor; if it mixes types, it is MFA. Do not confuse MFA with identity proofing, which verifies who a person is before credentials are ever issued, or with single sign-on, which reuses one authentication across many systems. MFA strengthens the login event itself.