Authentication is the process of proving that a user, device, or service is who or what it claims to be before access is granted. It answers the question “who are you?” and precedes authorization, which decides what you may then do.
Proof comes from three factor categories: something you know such as a password or PIN, something you have such as a token or phone, and something you are such as a fingerprint or face. Combining factors from different categories is far stronger than any one alone, because an attacker who steals a password still lacks the hardware token. Passwords remain the weakest common factor since they get reused, guessed, and phished. Watch out for treating two knowledge factors, like a password plus a security question, as though they were multi-factor, because they are not.
How is authentication tested on the CISSP?
Authentication is core to Domain 5, Identity and Access Management, covering factors, protocols, and federation. Questions test factor categories, when to require multiple factors, and protocols such as SAML, OAuth, and OpenID Connect. See Domain 5: Identity and Access Management.
NIST details the guidance in SP 800-63B.