Authentication Factors and MFA Traps

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Authentication Factors and MFA Traps

Key Takeaways Explain This Topic AI

MFA is real only when factors come from different categories: know, have, are, do, or somewhere you are.

A password plus a PIN is single-factor because both are knowledge; two prompts is not automatically MFA.

Push MFA is vulnerable to fatigue/bombing attacks, so number matching and phishing-resistant authenticators matter.

FIDO2/WebAuthn passkeys are phishing-resistant because they bind the credential to the origin and stay on the device.

Risk-based (adaptive) authentication raises requirements using context: device posture, location, behavior, sensitivity.

Last updated: June 2026

The Five Factor Categories

Authentication proves an identity claim. Security+ loves to show you two credentials and ask whether they are genuinely different factor types. Multifactor Authentication (MFA) requires factors from two or more distinct categories.

• Category Meaning Examples
• Something you know A remembered secret Password, passphrase, PIN, security question

Something you have A physical or logical token you possess Smart card, hardware security key, authenticator app, OTP token

• Something you are A biometric trait Fingerprint, face, iris, retina
• Something you do A behavioral pattern Typing rhythm, gait, signature dynamics
• Somewhere you are A location signal Managed office network, geolocation, impossible-travel check

The decisive rule: combining two items from the same category is still single-factor. Password plus PIN plus security question is one factor (knowledge) three times over. Password plus smart card is MFA; password plus fingerprint is MFA.

The MFA Quality Ladder

Not all second factors are equal. The exam wants you to rank them and to recognize their specific attacks.

• Method Strength note Main weakness
• Password only Single factor Credential theft = full access
• Password + PIN Still one factor type Both are knowledge
• Password + SMS code Better than password alone SIM swap , SS7 interception, phishing
• Password + app push Usable and common Push fatigue / MFA bombing
• Password + TOTP app Resists random push approval Still phishable on a fake login page
• FIDO2 / WebAuthn key or passkey Phishing-resistant, origin-bound Needs enrollment and recovery planning
• Smart card ( PIV ) + PIN Strong; private key stays on card Card loss and PIN handling need controls

Time-based One-Time Password (TOTP) codes rotate every 30 seconds but can still be typed into a phishing site. FIDO2/WebAuthn credentials are bound to the legitimate web origin and the private key never leaves the authenticator, which is why they are labeled phishing-resistant and why passkeys are the modern recommendation.

Trap Callout: Two Steps Are Not Always MFA

A password, then a security question, then a PIN is three knowledge prompts and one factor. Even a smart card plus a hardware key is two possessions, not two categories. Read for the category , never the number of prompts.

Biometrics and Their Error Rates

Biometrics are convenient but probabilistic, so SY0-701 expects three error terms:

• Term Meaning Why it matters
• False Acceptance Rate (FAR) Wrong person accepted High FAR is a security failure
• False Rejection Rate (FRR) Legitimate person rejected High FRR is a usability failure
• Crossover Error Rate (CER) Point where FAR equals FRR Lower CER = a better biometric system

Tuning the sensitivity higher lowers FAR but raises FRR, and vice versa. The CER is the standard quality comparison: between two scanners, the one with the lower CER is generally more accurate. Biometrics are also identifiers you cannot change , so a stolen fingerprint template is permanent. Always pair biometrics with a fallback, anti-spoofing (liveness detection), and privacy protection of stored templates.

Adaptive Authentication, Attack Clues, and a Scenario

Risk-based (adaptive) authentication changes requirements based on context. A login from a managed laptop on the corporate network may pass with one factor, while the same account from a new device in another country triggers a step-up challenge or a block.

• Scenario clue Likely issue Better control
• Repeated push prompts late at night MFA fatigue / bombing Number matching, rate limiting, user reporting
• Code typed into a fake portal OTP phishing FIDO2/WebAuthn or certificate-based auth
• Attacker ports the victim's phone number SIM swap Avoid SMS for high-risk access
• Logins from two countries minutes apart Impossible travel Risk-based challenge or block
• New unmanaged laptop reaches payroll Device posture risk Conditional access + device compliance
• Scenario Walkthrough

A help desk tech gets a call from someone claiming to be a locked-out executive who recites the exec's employee ID and demands an MFA reset. Knowledge of an ID is not proof. The correct move is an approved identity-verification and reset workflow with out-of-band or manager approval, and full logging, because MFA reset is a high-risk identity event attackers target directly.

Quick Drill

• Combination Is it MFA? Why
• Password + PIN No Two knowledge factors
• Password + TOTP app Yes Knowledge + possession
• Smart card + fingerprint Yes Possession + biometric
• Password + security question No Two knowledge factors
• FIDO2 key with user verification Yes Possession + local verification, phishing-resistant
• Hardware key + smart card No Two possessions, one category

A final exam reminder: passwordless authentication (a passkey or biometric unlocking a device-bound key) can still be multifactor when the local something you have device is unlocked by something you are or something you know . Do not assume "no password" means "single factor."