EC-Council Certified Security Specialist (ECSS) Practice Test

Requiring a second factor for verification is about two-factor authentication. It strengthens identity checks by demanding two independent credentials from different categories, so access isn’t granted if only one factor is known or possessed. Typically this means something you know (a password) plus something you have (a hardware token, a mobile authenticator, or a code sent to your device) or something you are (biometric data). Even if the first factor is compromised, the second factor prevents entry. Other options don’t verify identity with a second factor: policies focus on rules and enforcement rather than authentication itself; anti-virus/anti-phishing defenses protect systems but don’t require a second form of proof to log in; change management deals with controlling system changes, not user authentication.