An employer requires that employees use a key-generating app on their smartphones to log into corporate applications. In terms of authentication of an individual, this type of access policy is BEST de

This option is correct because a key-generating app on a smartphone functions as a security token that the user physically possesses. This 'something you have' factor in multi-factor authentication (MFA) relies on the user demonstrating ownership of a specific item, such as a physical token, smart card, or in this case, a smartphone running an authenticator app that generates time-based one-time passwords (TOTP) or receives push notifications.

This option is incorrect because 'something you know' refers to knowledge-based factors like passwords, PINs, or security questions, which are not what a key-generating app provides.

This option is incorrect because 'something you do' refers to behavioral characteristics or patterns like typing cadence or specific gestures, not the use of a key-generating application.

This option is incorrect because 'something you are' refers to inherent biometric attributes such as fingerprints, facial recognition, or iris scans, which are part of the user's physical self, not an external device or application.