Information Security Principles and Frameworks Practice Test

The main idea here is the categories used to verify identity in authentication. The three types—something you know, something you have, and something you are—are called factors. Naming them "factors" reflects the different kinds of evidence used to authenticate a person.

MFA is about using more than one of these factors together; it’s a method that leverages factors, not the category itself. A PIN is an example of a single factor (knowledge), not the overarching concept. Password best practices relate to how to create and manage passwords, not to the classification of authentication evidence. So the best term for describing those categories is factors.