Remote staff VPN into county resources. Leadership wants MFA that combines a memorized secret with a hardware security key, and may later add biometric unlock on managed phones. Which statement best reflects MFA factor classes?

Multi-factor authentication combines distinct factor classes so compromise of one secret is not enough. Something you know (a memorized password or PIN), something you have (a hardware security key or similar possession factor), and something you are (biometrics) are different classes. For remote staff VPN into county resources, pairing a memorized secret with a hardware security key correctly mixes know + have; recognizing that biometric unlock on managed phones can later add an are factor reflects proper MFA taxonomy rather than stacking look-alike secrets from the same class.

Two different passwords typed back-to-back remain two instances of something you know—they do not become separate factor classes. A username alone is an identifier, not authentication, regardless of length. Relying only on the building street address as a 'factor' is neither a user authenticator nor multi-factor; it is public location information attackers already know.

Exam caveat: SMS OTP is possession-ish but weaker than phishing-resistant security keys; SY0-701 emphasizes understanding factor classes and stronger authenticators. Also, biometric templates should stay on managed devices where possible; biometrics are factors, not a reason to skip device security.

Operational check: configure county VPN to require password plus hardware key (or equivalent phishing-resistant MFA), verify that registering two passwords is not accepted as MFA, and pilot biometric unlock only as an additional unlock path on managed phones tied to the existing MFA registration—not as a replacement for possession factors without policy review.