Which type of authentication factor is considered "something you have"?

The correct answer is a hardware token, which is classified as "something you have." This type of authentication factor requires the user to possess a physical device that generates a unique code or provides a method for accessing a system. Hardware tokens serve as a second layer of security by ensuring that even if someone knows your password, they cannot access your account without the physical token in their possession.

In contrast, a password is considered "something you know," as it relies on information that the user has memorized. A biometric scan, such as a fingerprint or facial recognition, falls under the category of "something you are," as it utilizes unique biological characteristics of the user for identification. A security question also pertains to "something you know" because it requires the user to recall specific information predetermined during the account setup. These distinctions are essential for understanding the multi-factor authentication model, which enhances security by using different categories of factors.