Comprehensive and Detailed In-Depth Explanation:
Authentication methods are categorized into three factors:
Something you know (e.g., passwords, PINs).
Something you have (e.g., ID cards, key fobs, smart cards).
Something you are (e.g., biometrics like fingerprints, retina scans).
Option C (A card-key scanner) aligns with "something you have", as it requires a physical token (card) for authentication.
Option A (Retina scan) and Option D (Fingerprint scanner) fall under biometric authentication ("something you are").
Option B (PIN code reader) is based on "something you know".
Thus, C is the correct answer because a card-key represents a physical access control mechanism based on possession.
Reference: IIA IT Security & Authentication Controls

Reference: IIA Business Knowledge for Internal Auditing, IT Application Controls section.