Which statement best describes authentication versus authorization?

Which statement best describes authentication versus authorization?

• A. Authentication verifies identity; authorization determines access to resources
• B. Authentication determines access to resources; authorization verifies identity
• C. Authentication is the process of encrypting credentials
• D. Authorization identifies the user

Answer: (A)

Authentication answers the question “Who are you?” by verifying your identity through credentials such as a password, smart card, or a Kerberos ticket. Once identity is verified, authorization decides what you are allowed to do, based on your permissions, group memberships, or roles, to determine which resources you can access and what actions you can perform. Think of it like this: authentication proves you are the user you claim to be; authorization determines what that user is allowed to do in the system. After you log in, the system uses your authenticated identity to check access rights—for example, whether you can open a file, modify it, or run a particular application. The other options mix up these roles: encrypting credentials is about protecting them, not proving identity; and identifying the user is what authentication does, not authorization.

Authentication answers the question “Who are you?” by verifying your identity through credentials such as a password, smart card, or a Kerberos ticket. Once identity is verified, authorization decides what you are allowed to do, based on your permissions, group memberships, or roles, to determine which resources you can access and what actions you can perform.

Think of it like this: authentication proves you are the user you claim to be; authorization determines what that user is allowed to do in the system. After you log in, the system uses your authenticated identity to check access rights—for example, whether you can open a file, modify it, or run a particular application. The other options mix up these roles: encrypting credentials is about protecting them, not proving identity; and identifying the user is what authentication does, not authorization.