Which of the following authentication types is being required when a user must swipe a key card and then enter a password before being allowed access to the server room?

Multi-factor authentication requires verification using two or more independent factor categories: something you know, something you have, or something you are. A key card represents the 'something you have' factor while a password represents the 'something you know' factor, making this a textbook MFA implementation. Because the two factors belong to different categories, compromise of one does not compromise the other.

Single sign-on allows a user to authenticate once and access multiple systems without re-entering credentials; it does not describe a two-step physical access process.

Biometric authentication relies on physical characteristics such as fingerprints or retina scans; neither a key card nor a password is a biometric factor.

Single-factor authentication uses only one factor category; this scenario uses two distinct categories, which disqualifies it.