Multi-factor authentication (MFA) is an access control that requires two or more verification factors from different categories before a user is admitted. The categories are knowledge (a password), possession (a token or phone), and inherence (a biometric), and the factors must come from separate categories to count.
Typical combinations pair a password with an authenticator app code, a smart card with a PIN, or a biometric with a hardware key. Each blend trades some convenience for security. Not all MFA is equal: codes sent by SMS can be intercepted or SIM-swapped, while phishing-resistant methods built on the FIDO2 standard bind the login to the legitimate site and resist interception. A frequent mistake is calling a password plus a security question multi-factor, when both are simply knowledge factors.
Why does MFA matter for the CISSP exam?
MFA is a key control in Domain 5, Identity and Access Management, especially for protecting privileged and high-value accounts. Expect questions on factor categories, appropriate implementations, and the weaknesses of SMS compared with app-based or hardware options. Review Domain 5: Identity and Access Management.
CISA maintains practical guidance in its MFA resources.