A server administrator needs to implement multifactor authentication (MFA) for remote access to a critical server's management interface. The security policy specifically requires the use of an authentication factor categorized as 'something you have'. Which of the following options fulfills this requirement?
A role-based access control (RBAC) policy limiting administrative commands.
A complex personal identification number (PIN) that is at least 8 characters long.
A retinal scan performed by a biometric reader.
A USB security key that must be inserted into the administrator's workstation.
The correct answer is a USB security key. The 'something you have' authentication factor in MFA refers to a physical object that the user possesses. A USB security key is a hardware device that the administrator must physically have to complete the authentication process.
A retinal scan is an example of 'something you are', which is a biometric factor.
A complex personal identification number (PIN) is an example of 'something you know', which is a knowledge-based factor.
A role-based access control (RBAC) policy is an authorization mechanism that defines permissions, not an authentication factor used to verify a user's identity.