Agree in mr. Jason

I have seen this question in many places from the recent exam dump stating this is the correct answer with no explanation of why this is the correct answer. Is this what someone said was the correct answer? Did they challenge it? The principle of MFA is to have credentials of different aspects. In the scenario you already have a key card (something you have) and a fingerprint (something you are). So to add another factor it needs to be something else. Retina scan is something you are so it is not adding an additional factor to the MFA. The same for Hard token (something you have). SMS text is not likely allowed in a secure area, and is again something you have. So the only option is a keypad PIN (something you know). This would add a third factor, which is the entire point of the definition Multi-factor authentication. If this explanation is wrong, can someone please explain why Retina scan is more correct?