Which statement correctly describes MFA factors?

• A. Something you know, something you have, and something you are; plus often biometric or contextual factor.
• B. Something you know, something you have, and something you are; there are no additional factors used.
• C. Something you do, something you are, and something you know; context rarely matters.
• D. Something you know, something you have, and something you are; used solely for password resets.

Answer: (A)

MFA factors are described by three main categories—something you know, something you have, something you are—and many implementations add biometric or contextual factors to strengthen the authentication. The statement that lists these three categories and also notes that biometric or contextual factors can be added captures the standard model and reflects real-world practice, where you combine multiple independent credentials for better security and sometimes include additional factors beyond the core trio.

Why this is the best fit: it accurately identifies the foundational categories and acknowledges that extra factors—like biometric data (something you are) or contextual clues such as location, device, or session context (contextual factors)—are commonly used to further secure access.

Why the other descriptions don’t fit: one option falsely claims there are no additional factors beyond the three, which ignores how MFA often leverages extra biometric or contextual cues. Another option uses a different category like something you do and downplays context, which isn’t the standard terminology and misrepresents how MFA typically functions. The last option suggests MFA is used only for password resets, but MFA is a broader approach used to authenticate access in general, not just for resets.