The question "which of the following is an example of two factor authentication" appears constantly in security certification exams, vendor documentation, and enterprise policy discussions. It sounds straightforward, but the answer requires understanding what actually counts as a separate authentication factor versus what is simply a second step in the same factor category.
Two-factor authentication requires credentials from two different categories: something you know, something you have, or something you are. A password plus a security question is not two-factor authentication - both are something you know. A password plus a one-time code from an authenticator app is two-factor authentication - one is something you know, the other proves possession of a device.
This distinction matters more than it might seem. Organizations that implement two steps within the same factor category get a false sense of security while leaving themselves vulnerable to the exact attacks that 2FA is designed to prevent.
The Three Authentication Factors
Authentication factors fall into three well-established categories that have remained consistent since the early days of access control theory.
Something you know includes passwords, PINs, security questions, and passphrases. These are knowledge-based credentials that exist only in the user's memory (or, more realistically, in their password manager). The weakness of this factor is that knowledge can be shared, guessed, or stolen through phishing without the legitimate owner knowing it has been compromised.
Something you have includes physical tokens, smart cards, mobile phones receiving SMS codes, authenticator apps generating TOTP codes, and hardware security keys like YubiKeys. Possession-based factors require an attacker to physically obtain or remotely compromise a specific device. This is a meaningfully higher barrier than stealing a password.
Something you are includes fingerprints, facial recognition, iris scans, and voice patterns. Biometric factors are tied to the user's physical characteristics. They are difficult to forge but impossible to change if compromised, which creates unique challenges for long-term credential management.
Concrete Examples of Two Factor Authentication
When someone asks which of the following is an example of two factor authentication, the correct answer always combines credentials from two different factor categories. Here are the most common implementations deployed in production environments today.
Password plus SMS code. The user enters their password (something they know), then receives a one-time code via text message to their registered phone number (something they have). This is the most widely deployed form of 2FA, though it is also the weakest due to SIM swapping attacks and SS7 vulnerabilities. Despite its limitations, it remains significantly better than password-only authentication.
Password plus authenticator app. After entering a password, the user opens an app like Google Authenticator, Authy, or Microsoft Authenticator to retrieve a time-based one-time password (TOTP). The authenticator app runs on a device the user possesses, making this a true two-factor combination. TOTP codes rotate every 30 seconds, limiting the window for interception.
Password plus hardware security key. The user enters their password, then touches a physical security key (such as a YubiKey or Titan Security Key) connected via USB or NFC. Hardware keys use cryptographic challenge-response protocols - typically FIDO2/WebAuthn - that are resistant to phishing because the key verifies the origin of the authentication request. This is widely considered the strongest commonly available form of two-factor authentication.
Password plus push notification. After password entry, the user receives a push notification on a registered mobile device and must approve the login attempt. Services like Duo, Okta Verify, and Microsoft Authenticator use this approach. The phone serves as the possession factor, and the push mechanism provides better usability than manually typing codes.
PIN plus biometric. Some systems combine a PIN (something you know) with a fingerprint scan (something you are). This is common in mobile banking applications where the device itself is implicitly the possession factor, and the PIN plus biometric provide the second and third factors for high-value transactions.
What Is Not Two Factor Authentication
Equally important is understanding which combinations fail to qualify as true 2FA, even though they may feel more secure than a single password.
Password plus security question is not two-factor authentication. Both are knowledge-based factors. An attacker who can phish a password can likely find answers to security questions through social media research or social engineering.
Two different passwords is not two-factor authentication. Entering a primary password and then a secondary password is still single-factor, repeated twice. If both can be stolen through the same phishing page, the additional step provides minimal security benefit.
Password plus CAPTCHA is not two-factor authentication. CAPTCHAs are bot-detection mechanisms, not identity verification. They do not prove that the person solving the CAPTCHA is the legitimate account owner.
Two Factor Authentication in Enterprise Environments
Enterprise deployments of two-factor authentication face different constraints than consumer applications. The user population is known and managed, compliance requirements dictate minimum authentication standards, and the cost of account compromise can be measured in regulatory fines and breach notification expenses.
Most enterprise identity providers - Okta, Azure AD, Ping Identity, and Auth0 among them - support multiple 2FA methods and allow administrators to enforce specific factor combinations based on risk level. A typical policy might require password plus push notification for standard access, escalating to password plus hardware key for privileged operations or access to sensitive data.
Conditional access policies add another dimension by evaluating contextual signals - device posture, network location, login time, and behavioral patterns - to determine when to require the second factor. A user logging in from a managed device on the corporate network during business hours might be prompted less frequently than the same user connecting from an unfamiliar location at an unusual time.
The Shift Toward Passwordless and Beyond
The identity security community is increasingly moving beyond the traditional 2FA model toward passwordless authentication. FIDO2/WebAuthn enables authentication using only a hardware key or platform authenticator (like Touch ID or Windows Hello), eliminating the password entirely. In this model, the device is something you have and the biometric unlock is something you are - still two factors, but without the weakest link in the chain.
Passkeys, the consumer-friendly implementation of FIDO2, are accelerating this transition. Apple, Google, and Microsoft have all integrated passkey support into their platforms, and major websites are beginning to offer passkeys as a primary authentication method.
For organizations evaluating their authentication strategy, the practical advice remains the same: any form of two-factor authentication is dramatically better than passwords alone. Start with what your users will actually adopt, then incrementally move toward stronger factors as the technology matures and user expectations evolve.