An employee logs into the corporate VPN by entering a password and then typing a six-digit code displayed on a physical key fob issued by the company. The security team wants to classify each element used during this login. How should the physical key fob be categorized?