A knowledge factor is an authentication factor based on something the claimant knows, such as a password, PIN, or security-question answer. section 11.3.2
Use these distinctions when classifying authentication methods:
- Passwords, PINs, and security-question answers are knowledge factors. section 11.3.2
- A password and PIN together still provide only one factor category because both are something the user knows. section 11.3.2
- Possession factors include badges, smartphones, and authenticator applications; inherence factors include biometric scans. section 11.3.2
Password plus SMS code
A username and password provide a knowledge factor. An SMS code delivered to the user’s smartphone adds a possession factor, making the combination multifactor authentication. section 11.3.2
Review the authentication-method classification exercise for exam-style identification of knowledge, possession, and inherence factors. section 11.5.2
