A Chief Information Security Officer (CISO) wants to implement two-factor authentication within the company. Which of the following would fulfill the CISO's requirements?

A username and password are both 'something you know' factors, making this single-factor authentication despite using two separate credentials.

A retina scan and a fingerprint scan are both 'something you are' biometric factors - using two items from the same factor category does not constitute two-factor authentication.

A USB token represents the 'something you have' factor category, while a PIN represents the 'something you know' factor category - combining factors from two distinct categories is the definition of true two-factor authentication. This ensures that compromising one factor alone is insufficient for an attacker to gain access.

A proximity badge and a token are both 'something you have' factors, which means this is still single-factor authentication using two items from the same category.