Which of the following is NOT listed as one of the four bases for authentication credentials?

• A. What you know
• B. What you are
• C. What you have
• D. What you do

Answer: (B)

The idea being tested is how authentication credentials are categorized into different bases or factors used to verify identity. In this four-base framing, the bases typically include something you know (like a password), something you have (a token or smart card), something you do (a behavioral trait such as typing dynamics), and a fourth factor that depends on context (such as location or device context). The option describing what you are (biometrics) isn’t part of this particular list, so it’s the one that isn’t listed among the four bases. The other choices fit the included bases: what you know maps to knowledge-based credentials, what you have to possession-based credentials, and what you do to behavior-based credentials.