Which example describes 'something the individual knows' in authentication?

• A. Email address
• B. Password
• C. Iris scan
• D. Smart card

Answer: (B)

In authentication, "something the individual knows" refers specifically to information that only the individual is expected to possess and can be used to verify their identity. A password fits this definition perfectly because it is a secret word or phrase that the user creates and keeps confidential, serving as a unique identifier linked to their account or identity.

The focus of authentication based on knowledge is to ensure that access is granted solely to those who possess the correct information, thereby providing a straightforward method of verifying identity. The reliance on a password means that if someone gains unauthorized access to that specific knowledge, they can impersonate the rightful user.

In contrast, an email address is a unique identifier but does not serve as a secure method of authentication by itself, as it can be easily guessed or obtained. An iris scan and a smart card, on the other hand, fall under different categories of authentication—biometric and possession-based, respectively—where the authentication relies on physical characteristics or physical tokens rather than knowledge.