What does MFA stand for?
MFA stands for Multifactor Authentication. Authentication with two or more different factor types, such as something you know, have or are. Two passwords are still one factor.
MFA asks for proof from at least two different categories: something you know (a password or PIN), something you have (a phone, a hardware key, a smart card) and something you are (a fingerprint or face). The categories must differ. A password plus a security question is still one factor, because both are things you know.
MFA in practice: an example
A user types a password and then approves a number-matching prompt in an authenticator app. An attacker who buys the password from a breach cannot sign in without the phone. Phishing-resistant options such as FIDO2 keys go further, because they will not answer a request from a fake site.
What MFA is confused with
MFA vs 2FA: what is the difference?
Two-factor authentication is MFA with exactly two factors. Every 2FA setup is MFA; MFA can also use three.
MFA vs SSO: what is the difference?
SSO reduces how often you sign in. MFA makes each sign-in stronger. They are normally used together. What SSO stands for
Which exams cover MFA?
MFA is on the official CompTIA acronym list for all four exams covered here.
- Security+ SY0-801: 2.5 (Threats, Vulnerabilities, and Attacks); 4.5 (Security Operations).
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- Network+ N10-009: 4.0 (Network Security).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which combination is multifactor authentication?
- Password and PIN
- Fingerprint and face scan
- Smart card and PIN
- Two different passwords
Show the answer
C. Smart card and PIN. A smart card is something you have and a PIN is something you know. The other options use two items from the same category.
2. Users approve sign-in prompts they did not start, and an attacker gets in. What reduces this risk most?
- Longer passwords
- Number matching or a FIDO2 security key
- A shorter screen lock timeout
- Password hints
Show the answer
B. Number matching or a FIDO2 security key. Push-fatigue attacks rely on a blind approval. Number matching forces the user to read the sign-in screen, and FIDO2 keys do not respond to requests from the wrong site.
Sources: NIST glossary: multi-factor authentication; NIST SP 800-63B, Digital Identity Guidelines: Authentication. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.