Free CompTIA Security+ SY0-701 Practice Question

A security token generates a pseudo-random code or has a built-in mechanism that changes the code it provides at regular intervals, which users must input for authentication. This matches the 'something you have' factor category, as it's a physical object the user must possess to gain access. SMS messages, though they can technically fall under 'something you have' since they are sent to a device you own, are not the best choice due to security concerns such as interception or SIM swapping. Passwords are 'something you know' and biometrics are 'something you are,' hence are not classified under 'something you have' for authentication factors.