Which set of access control solutions implements two-factor authentication?

A USB token belongs to the 'something you have' category (a physical possession factor), while a PIN belongs to the 'something you know' category (a knowledge factor), placing them in two separate authentication factor types. Combining factors from different categories satisfies the definition of multi-factor authentication, providing stronger security because compromising one factor type does not automatically compromise the other. This is the only option in the list that spans two distinct factor categories.

A fingerprint scanner and a retina scanner are both biometric 'something you are' factors, making this single-factor authentication despite using two separate biometric devices.

Both a password and a PIN are 'something you know' knowledge-based credentials, so combining them represents single-factor authentication using two instances of the same factor type.

An account name and a password are both knowledge-based 'something you know' factors, providing only single-factor authentication regardless of how they are presented together.