Two-factor authentication (2FA) enhances security by requiring two different authentication factors from the following categories:

Something you know (e.g., password, PIN)

Something you have (e.g., smart card, key fob)

Something you are (e.g., fingerprint, facial recognition)

The combination of a fingerprint (biometric authentication) and a PIN (knowledge-based authentication) satisfies two-factor authentication requirements.

A. The user's facial geometry and voice recognition – Incorrect. Both are biometric factors (something you are), meaning this is single-factor authentication.

B. The user's password and a separate passphrase – Incorrect. Both are knowledge-based factors (something you know), making this single-factor authentication.

C. The user's key fob and a smart card – Incorrect. Both are possession-based factors (something you have), meaning this is not true two-factor authentication.

D. The user's fingerprint and a personal identification number (PIN) (Correct Answer) – This combines biometric authentication (fingerprint) with knowledge-based authentication (PIN), fulfilling two-factor authentication.

IIA GTAG 15 – Information Security Governance emphasizes multi-factor authentication as a key security control.

NIST SP 800-63B – Digital Identity Guidelines defines two-factor authentication as requiring two distinct categories of authentication.

COBIT 2019 – DSS05 (Managed Security Services) highlights 2FA as a best practice for access control.

Explanation of Each Option:IIA References: