The authentication mechanism that falls under the category of “Something you know” typically refers to knowledge factors, which are based on information that the user must be able to recall and provide upon request. In the context of CyberArk Defender Access, a security question is an example of a knowledge factor because it requires the user to answer a question that only they should know the answer to. This contrasts with other mechanisms like a phone call or text message, which are considered “Something you have” because they rely on the user possessing a specific device to receive the call or message. FIDO2 Authenticators, on the other hand, are categorized as “Something you are” or “Something you have,” depending on the specific type of authenticator used, as they can include biometric factors or a physical security key1. References: CyberArk’s definition of MFA