In two-factor authentication, what is typically used as the second factor?

• A. A code sent to the pre-determined mobile number or email address
• B. A password
• C. A biometric scan
• D. A security question

Answer: (A)

Two-factor authentication requires proof of two different things. The second factor is typically a temporary code sent to a device you own, such as a phone or an email address, which you must enter to complete login. This one-time code, which expires, demonstrates you have access to that device. While a password is something you know and biometrics are something you are, the common second factor in many systems is this code delivered to a trusted device, making it the best answer. Security questions are not reliable as a second factor.