Which statement about authentication credentials is true?

• A. They can be based on what you know or what you have
• B. They rely solely on passwords
• C. They are identical for all users
• D. They are not related to access control

Answer: (A)

Authentication credentials are the evidence used to prove who you are before granting access. They can be based on what you know (like passwords or passphrases) or what you have (such as security tokens or smart cards). Some systems also use biometrics, which are based on what you are. Because credentials can involve knowledge or possession (and often both in multi-factor setups), the statement is true: they are not limited to passwords and can take different forms.

Choices that say credentials are solely passwords are incomplete, and those claiming all users share identical credentials or that credentials aren’t related to access control contradict how authentication and access control work.