An information security professional is reviewing user access controls on a customer-facing application. The application must have multi-factor authentication (MFA) in place. The application currently

Geolocation is a contextual risk signal used in adaptive authentication, not a recognized MFA factor category (know/have/are), so it does not constitute a second authentication factor.

A pre-selected number is static information the user knows in advance, making it equivalent to a second password and still within the single 'something you know' factor category, which does not satisfy MFA.

A secret question is also 'something you know,' meaning it remains within the same single factor category as the existing password and therefore does not fulfill the multi-factor requirement of using distinct factor types.

A hardware token generates a time-based or event-based one-time password (OTP), which represents the 'something you have' factor - a physical device in the user's possession. Combined with the existing username and password ('something you know'), this satisfies the MFA requirement of using two distinct authentication factor categories, making it a true and robust MFA implementation.