The correct answer is Smart card token.

Smart card token is a physical device that stores cryptographic credentials or private keys and proves possession during authentication. It is classified as a something you have factor because the user must physically present or insert the card or token to authenticate. Smart cards are often used together with a PIN so that possession and knowledge are combined for stronger authentication.

Biometric fingerprint is incorrect because fingerprints are biometric traits and belong to the something you are category rather than a possession factor.

Cloud Identity is incorrect because it names an identity service or account and not a physical object that a user possesses. An identity provider is not a something you have authentication factor in the classic model.

Secret passphrase is incorrect because a passphrase is information the user knows and therefore fits the something you know category instead of a possession factor.

Full AWS Practitioner Certification Question