Charles has configured his multifactor system to require both a PIN and a password. How many effective factors does he have in place once he presents both of these and his username?

While it may appear that Charles has put forth two factors, he has actually presented two categories of information that he possesses along with his identity. In order to establish a genuine multifactor environment, it is necessary for him to utilize more than just a single element from the categories of something you have, something you know, and something you are.