MFA factor combinations: why two passwords isn't MFA

What MFA actually means

Multi-Factor Authentication means the user presents two or more factors from different categories before the system grants access. The key word is "different." Two of the same factor, no matter how strong each one is, does not satisfy MFA. A 32-character password plus a security question is still single-factor, because both items are "something you know." If the attacker steals one, they probably have the other.

This is the most-missed concept on Security+ Domain 4.6 (Identity and Access Management). CompTIA writes scenario questions where three of the four answer choices are "something you know" variants and one is a different category. Categorize before you pick and the answer falls out. Skip the categorization and the trap closes around you.

The five factor categories Security+ tests

Security+ recognizes five factor categories. The first three are the classic three; the last two are context-aware additions that show up in scenario questions and conditional access policies.

• Something you know. A secret only the user should know. Password, PIN, passphrase, answer to a security question.
• Something you have. A physical item only the user should have. Smartcard, YubiKey, phone with a TOTP app (Time-based One-Time Password), hardware token, FIDO2 security key.
• Something you are. A biometric trait of the user's body. Fingerprint, face scan, iris scan, voice print.
• Somewhere you are. The user's physical or network location. Geofencing, IP-based location restrictions, GPS check. Often used as a risk signal inside conditional access rather than as a standalone factor.
• Something you do. A behavioral pattern unique to the user. Keystroke dynamics, mouse-movement patterns, gait analysis, signature dynamics. Newer category, mostly used as a continuous-authentication signal.

For more on the foundational pieces (CIA triad, AAA, and where these factors sit inside Authentication), the fundamental security concepts lesson (SP-1.2) covers the framework. The factor categories live there in their simplest form.

Common combinations and what they protect against

Not every valid MFA pairing protects against every attack. The combination decides which attacks fail and which still get through.

• Password plus TOTP code. Defeats basic credential stuffing and password spraying. Attacker buys a leaked password and cannot complete sign-in without the rotating 6-digit code. Still vulnerable to real-time phishing, where the attacker proxies a fake sign-in page and replays the code immediately.
• Password plus push notification. Defeats most phishing because the user has to physically approve on a trusted device. Still vulnerable to MFA fatigue (spam the approvals until the user taps yes) and to session-token theft after sign-in.
• Password plus hardware security key (FIDO2). Defeats phishing entirely. The key signs a challenge bound to the real site's origin, so a fake page cannot trigger a valid response. This is the strong baseline regulators are converging on.

FIDO2 and WebAuthn: the gold standard

FIDO2 with WebAuthn is phishing-resistant by design. Three properties make it work. The key uses public-key cryptography, so no shared secret travels between the user and the server. The browser binds the challenge to the actual site origin, so a phishing site at a lookalike domain cannot get a valid signature even if the user is fooled. User presence is required, usually a touch or biometric, so a remote attacker cannot trigger the key silently.

Real implementations are widely available now. YubiKey hardware keys plug into USB or tap NFC. Apple Passkeys and Google Passkeys use the device's secure enclave to act as the key. Windows Hello uses the TPM as the key. The user experience is faster than typing a password, and the security properties are stronger than any code-based factor.

Real MFA failures and what they teach

Three high-profile incidents show how MFA fails when the wrong factor is chosen. CompTIA writes PBQs that look exactly like these scenarios.

• The 2022 Uber breach. An attacker phished an employee's password, then spammed push notifications to the employee's phone until the employee approved one to make the alerts stop. Classic MFA fatigue. Push notifications without number matching (where the user has to type a number shown on the sign-in screen into the app) cannot defend against this. The fix is number matching, push throttling, or moving to a phishing-resistant factor.
• The 2023 Reddit phishing breach. An attacker built a fake employee portal, captured the password, and asked the employee to type their TOTP code into the fake page. The attacker proxied the code to the real portal in real time. TOTP is not phishing-resistant. The user can be tricked into reading a valid code into a fake page, and the attacker has 30 seconds to use it. FIDO2 would have refused the request because the origin would not match.
• SIM swap attacks against SMS-based MFA. Numerous high-profile cases (executives, crypto holders, journalists) where an attacker social-engineered a carrier into porting the victim's phone number to a SIM the attacker controls. Every SMS code, including the MFA code, now lands on the attacker's phone. NIST SP 800-63B has formally discouraged SMS for high-assurance authentication since the 2020 update. Better than no MFA, but treat it as the weakest factor.

How Security+ tests this

Domain 4.6 (Identity and Access Management) carries the heaviest weight on factor questions, but you will see them surface in Domain 1.2 (fundamental concepts) and Domain 4.5 (enterprise security capabilities) too. The exam loves three patterns.

• The "same category trap" pattern. Two items that look different but are both "something you know" (password and PIN, password and security question). Wrong answer if the question asks for valid MFA.
• The "defeats which attack" pattern. The scenario names a specific attack (credential stuffing, phishing, SIM swap, MFA fatigue) and asks which combination would have stopped it. The answer pivots on whether the factor is phishing-resistant.
• The PBQ pattern. A drag-target or hotspot interaction where you assign factor categories to the right examples. Memorize the five categories and the examples in each, and these are free points.

For the deep dive on factor implementations, password policy, and the protocols that bind them together (SAML, OIDC, OAuth, LDAP), work the IAM lesson (SP-4.6). When you are ready to sit a full-length under time pressure, run a Practice Exam. Factor questions show up on every sit.

Where to go next

If you are tracking toward Security+, the Security+ track page has the full objective map and what each domain covers. If you are already in the platform, head to the dashboard and review Domain 4 in the Mastery Index with its evidence-quality label. Factor combinations land in Domain 4.6 and they are usually the fastest objective to lock in.

Questions about your specific path? Email the team. We reply personally, usually within a day.

About the authors

Nick Miller

Founder and Lead Author

IT Service Center Manager and former CTE / IT teacher. Owner of Revtek in Chicago's south suburbs. Writes everything that ships under his name and reviews every line of Revy-assisted drafting before publish.

LinkedIn ↗

R

Revy

Study buddy · AI co-author

Revy helps draft and structure these posts. Every piece is reviewed, edited, and fact-checked by Nick before publish. We disclose this here because it is the right thing to do. See the AI Policy for the full stance.