What is Multi-factor authentication (MFA)?

Proving who you are with two or more different kinds of evidence.

In plain English

The three kinds are something you know (a password or PIN), something you have (a phone, security key or card) and something you are (a fingerprint or face). MFA needs at least two different kinds. Two passwords are still only one kind, so that is not MFA.

Example

Typing a password and then approving a prompt on your phone is MFA. A password plus a security question is not, because both are things you know.

Where you will meet it

This idea belongs to the subject area of these practice tests. We do not publish or predict real exam questions.

• ISC2 CC practice tests
• Cisco CCST Cybersecurity practice tests
• CompTIA Tech+ practice tests

Related terms

• Least privilege: Give every person and system only the access they need to do their job, and nothing more.
• Phishing: A scam message that tricks you into giving up a password, money or access.
• Zero trust: A security approach that never assumes a request is safe just because it comes from inside the network.

Written and checked by the Be Ready Education team, last reviewed 2 November 2026. General study information, not professional advice. Providers change names and rules, so confirm details on the official documentation. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.