Which scenario represents true multi-factor authentication (MFA)?
A.Entering a password plus a PIN
Password and PIN are both 'something you know' — single category, not MFA.
B.Entering a password (knowledge) plus approving a notification on a phone app (possession)
Knowledge (password) + possession (phone) = two categories. Correct.
C.Using two different authenticator apps on the same phone
Two authenticator apps are the same possession factor.
D.Answering two security questions
Both security questions are knowledge factors.
Why this answer
MFA requires factors from at least two categories: something you know (password/PIN), something you have (phone, hardware key), something you are (biometrics). Two factors from the same category (password + PIN) is not MFA.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Access practice session.
Practice Identity & Access