How do you stop the wrong person from logging in, while also letting the right person do only what they are supposed to do? That is the core problem that authentication and authorisation methods solve. For the CC exam, you need to understand the difference between proving identity and granting permission, because the whole security model of an organisation hangs on getting both right.
Jump to a section
A simple way to picture Authentication and Authorization Methods
Have you ever waited in line to get into a busy nightclub? How does the bouncer decide who gets in and what they can do once inside?
First, you approach the door. The bouncer asks for your ID. This is authentication — proving who you are. You hand over your driver's license, and the bouncer checks your photo and birth date. If the ID matches your face and isn't fake, the bouncer confirms you are who you claim to be. Now you have proven your identity.
But you are not through the door yet. Next, the bouncer consults a clipboard — the VIP list. This list says which authenticated people are allowed in. This is authorisation — determining what a verified user is allowed to do. Some names on the list grant access to the general floor. Other names grant access to the VIP lounge. A few names even allow entry to the backstage area. Even though you have proven your identity, you can only enter the areas your name on the list permits.
Inside, the system continues. A bartender might ask for your wristband before serving you. The wristband was given based on the VIP list. It is a token that proves your authorisation level without you showing your ID again. The wristband saves time and reduces friction, just like a digital session token in a computer system.
Without authentication, anyone could claim to be anyone. Without authorisation, everyone who proved their identity would have the same unlimited access. Both steps are essential for security, just like the bouncer and the VIP list work together to protect the club.
Authentication and authorisation are two separate but connected security processes. They are often confused, but they answer different questions.
Authentication answers: "Who are you?" It is the process of verifying a users identity. When you log into a website with a username and password, you are authenticating. The system checks your password against a stored hash (a scrambled version of your password) to confirm you are the account owner. Common authentication methods include:
Passwords: A secret string of characters known only to the user. The system compares the entered password against a stored hashed version.
Biometrics: Physical or behavioural characteristics unique to an individual, such as fingerprints, facial recognition, or iris scans. These are hard to copy but can be expensive to implement.
Multi-Factor Authentication (MFA): Combining two or more different types of authentication factors: something you know (password), something you have (a phone or hardware token), and something you are (fingerprint). MFA significantly reduces the risk of account takeover.
Smart Cards: A physical card with an embedded chip that stores a digital certificate. The user inserts the card into a reader and may also enter a PIN.
Single Sign-On (SSO): A system where one authentication event grants access to multiple applications. The user logs in once and can then access all connected services without re-entering credentials.
After authentication is successful, authorisation begins. Authorisation answers: "What are you allowed to do?" It defines the permissions granted to an authenticated user or system. For example, after you log into your email, you are authorised to read your own messages but not someone elses. Authorisation is implemented through access control models.
The main access control models tested on the CC exam are:
Discretionary Access Control (DAC): The owner of a resource (like a file) decides who can access it. The owner sets permissions for each user or group. This is flexible but can lead to security holes if owners are careless.
Mandatory Access Control (MAC): Access is based on security labels assigned to users and resources. A system policy, not the resource owner, determines access. Used in high-security environments like military systems.
Role-Based Access Control (RBAC): Access is granted based on a users role within an organisation. For example, all managers in a company are assigned a "Manager" role that has permission to approve expense reports. New employees are assigned roles automatically. This simplifies administration.
Attribute-Based Access Control (ABAC): Access decisions are based on attributes of the user, resource, and environment. For example, a user can access a document only if their department is "Finance" AND the current time is between 9 AM and 5 PM AND the document sensitivity is "Internal". This is very flexible but complex to manage.
A key exam concept is the difference between identification, authentication, and authorisation. Identification is claiming an identity (e.g., typing your username). Authentication is proving that identity (e.g., entering your password). Authorisation is granting permissions after authentication (e.g., allowing you to view your dashboard). These three steps always happen in order.
Another important concept is the principle of least privilege. This means a user or system should be given only the minimum permissions necessary to perform their job. If a user only needs to read a file, they should not be given write permissions. This limits damage if an account is compromised.
Finally, understand that authentication and authorisation are not one-time events. Many systems use session management to track authenticated state. Once authenticated, a user receives a session token (like a digital handshake) that authorises them for the duration of their session without re-entering their password. This token can expire after a set time or when the user logs out.
Identification
The user claims an identity by providing a username, email address, or account number. This step does not prove anything; it simply declares who the user purports to be. The system uses this to look up the corresponding account record.
Authentication
The user provides proof of identity, such as a password, fingerprint, or one-time code from a hardware token. The system compares this proof against the stored credentials for the identified account. If they match, the user is authenticated.
Session Creation
Once authenticated, the system creates a session object with a unique session ID. This session ID is sent to the users browser or app as a cookie or token. This token represents the authenticated state and avoids the need to re-enter credentials on every request.
Authorisation Check
When the user requests a resource (like a file or webpage), the system checks the users permissions against the access control model in use (e.g., RBAC, DAC). It asks: 'Is this authenticated user allowed to perform this action on this resource?' The session token is used to identify the user during this check.
Access Granted or Denied
Based on the authorisation check, the system either grants access to the requested resource or denies it. If denied, the user may receive an 'Access Denied' or '403 Forbidden' message. The system logs the event for auditing purposes.
Session Termination
When the user logs out or the session expires (due to inactivity or a fixed time limit), the session token is invalidated. After this, the user must re-authenticate to gain access again. This prevents unauthorised use of an abandoned session.
Imagine you are an IT administrator for a mid-sized company called GreenLeaf Analytics. The company has 200 employees, uses cloud-based software for email, project management, and accounting, and stores sensitive client data. Your job is to implement authentication and authorisation correctly.
First, you set up authentication. You decide to enforce Multi-Factor Authentication (MFA) for all employees. Why? Because passwords alone are weak. Employees reuse passwords, fall for phishing emails, and write passwords on sticky notes. With MFA, even if a password is stolen, the attacker cannot log in without the second factor — a code sent to the employees phone. So you configure the system to require a password plus a one-time code from an authenticator app.
Next, you implement Role-Based Access Control (RBAC) for authorisation. You identify three main roles in the company:
Employee: Can access email, internal wiki, and their own timesheet. Cannot view other employees salary data.
Manager: Has same access as Employee, plus can approve timesheets for their reports and view team project dashboards.
Admin: Full access to all systems, including user account management, billing, and security settings.
You create these roles in your Identity Provider (IdP), which is Microsoft Entra ID. When a new employee joins, you assign them the Employee role. The IdP automatically provisions their access to all connected applications based on that role. You do not have to go into each application separately.
Now, a real incident occurs. An attacker phishes a manager and steals their password. However, because MFA is enabled, the attacker cannot authenticate. The manager reports the phishing email, you reset their password, and no damage is done.
Later, a different employee leaves the company. You disable their user account in the IdP. Within minutes, that employee loses access to all systems. You do not have to manually remove them from each app.
Finally, you run an audit. You check who has Admin role assigned. You find three people who were given Admin access years ago for a project and never had it removed. You revoke their Admin role and give them the Employee role instead. This follows the principle of least privilege — you reduced unnecessary administrative access.
In a real IT job, you would use tools like access reviews (scheduled checks of who has which permissions), conditional access policies (e.g., block access from untrusted countries), and logging to monitor failed authentication attempts. You would also create a policy for password complexity and rotation. The CC exam expects you to know these practical applications.
The CC exam tests your understanding of authentication and authorisation methods in several specific ways. You will face multiple-choice questions that present a scenario and ask you to choose the correct method or model.
Question types you will see:
Scenario-based identification: The question describes a situation (e.g., a company wants to use fingerprints to log in) and asks you to identify the method being used (biometrics).
Comparison questions: You are asked to distinguish between two concepts, such as authentication vs. authorisation, or DAC vs. MAC.
Definition questions: Straightforward questions asking the meaning of a term like Multi-Factor Authentication or Role-Based Access Control.
Best-choice questions: The scenario presents a security problem (e.g., weak passwords) and you must pick the best solution (e.g., implement MFA).
Traps they set:
Confusing authentication with authorisation. A classic trap: the question says "a user types their password" and asks what is happening. The answer is authentication, not authorisation. The exam loves to swap these terms in distractor answers.
Mixing up access control models. They will describe a situation where a file owner sets permissions (that is DAC) and ask you to identify the model. Beginners often pick RBAC because they remember roles, but roles are not mentioned in the scenario.
Overlooking the distinction between identification and authentication. A question might say "a user enters their username" and ask what step this is. The answer is identification, not authentication. Usernames alone do not prove identity.
Thinking MFA is any two factors of the same type. That is wrong. MFA requires factors from at least two different categories. Two passwords is not MFA.
Believing SSO and MFA are mutually exclusive. They are not. You can and should use MFA together with SSO. SSO handles authentication once, and MFA strengthens that single authentication event.
Concepts they love to test:
The three authentication factor types: Something you know (password), something you have (token), something you are (biometric).
The difference between DAC and MAC (owner controls vs. system controls).
RBAC definition and example scenarios.
The principle of least privilege and why it matters.
Identification vs. authentication vs. authorisation order.
The fact that biometrics are used for authentication, not authorisation.
Key definitions to memorise:
Authentication: Verifying identity.
Authorisation: Granting permissions after verification.
MFA: Using two or more different factor types.
DAC: Owner-set permissions.
MAC: System-enforced labels.
RBAC: Role-based permissions.
Format your revision by making flashcards of these definitions and practice scenarios. The exam will ask you to apply these concepts, not just recite them.
Authentication proves who you are; authorisation determines what you are allowed to do after that proof.
Multi-Factor Authentication requires at least two different factor types from (know, have, are) to be effective.
In Mandatory Access Control, a central policy controls access; in Discretionary Access Control, the resource owner sets permissions.
Role-Based Access Control assigns permissions to roles, not individuals, making administration simpler and more consistent.
The principle of least privilege means giving users the minimum permissions they need to do their job and no more.
Identification (claiming an identity) always comes before authentication (proving that identity), which always comes before authorisation (granting access).
Session tokens, like a wristband at a party, allow an authenticated user to make authorised requests without re-entering credentials for a limited time.
Biometrics are a strong authentication method but cannot be easily reset if compromised, unlike passwords.
These come up on the exam all the time. Here's how to tell them apart.
Authentication
Answers: 'Who are you?'
Uses passwords, biometrics, tokens as proof
Happens before authorisation
Authorisation
Answers: 'What are you allowed to do?'
Uses access control models like RBAC or DAC
Happens after authentication succeeds
Discretionary Access Control (DAC)
Resource owner sets permissions
Very flexible
Common in personal and small business systems
Mandatory Access Control (MAC)
Central authority sets permissions using labels
Very rigid, high security
Used in military and government classified systems
Role-Based Access Control (RBAC)
Permissions assigned to roles
Simpler to manage
Less granular than ABAC
Attribute-Based Access Control (ABAC)
Permissions based on user, resource, and environment attributes
More complex to implement
Very granular and context-aware
Password
Something you know
Can be changed if compromised
Vulnerable to phishing and guessing
Biometric
Something you are
Cannot be changed if compromised (no reset)
Harder to steal or replicate
Single-Factor Authentication
Uses one factor type only
Less secure
Easier for users
Multi-Factor Authentication
Uses two or more different factor types
Much more secure
Slightly less convenient for users
Mistake
Passwords are a type of authorisation.
Correct
Passwords are a type of authentication. They verify who you are. Authorisation determines what you can do after you are authenticated.
The words sound similar and are often used interchangeably in casual conversation. Beginners conflate the two processes.
Mistake
Multi-Factor Authentication means using any two security measures, like a password and a security question.
Correct
MFA requires factors from at least two different categories: something you know, something you have, or something you are. Two passwords are still one factor type.
Marketing materials sometimes use 'two-step verification' loosely, and beginners confuse step count with factor diversity.
Mistake
Once authenticated, you are authorised to do everything in the system.
Correct
Authentication and authorisation are separate. You can be authenticated (proven identity) but have very limited authorisation (only read a specific folder).
In many personal apps like email, once you log in, you have full access to your own account. Beginners extrapolate this to enterprise systems, where permissions are granular.
Mistake
Biometrics are used for authorisation because they determine what you can access.
Correct
Biometrics are always used for authentication — they verify your identity. Authorisation happens separately, after biometric verification, based on policies or roles.
Because unlocking your phone with your fingerprint directly opens your apps, it feels like the fingerprint is granting access. But the phone already has your identity stored, and the fingerprint just confirms it.
Mistake
Role-Based Access Control means each user gets unique permissions tailored specifically to them.
Correct
RBAC groups users into roles, and permissions are assigned to roles, not individuals. Everyone in the same role gets the same base permissions.
The word 'role' implies a specific job function, but beginners think it means a custom profile. In reality, RBAC sacrifices individual customisation for administrative simplicity.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Authentication is the process of verifying who you are (e.g., entering a password). Authorisation is the process of determining what you are allowed to do after your identity is verified (e.g., read or write a file).
Yes. You need to know the definitions of DAC, MAC, RBAC, and ABAC, and be able to identify which model is being used in a given scenario. The exam commonly tests the difference between DAC and MAC.
No. SSO allows you to log in once and access multiple applications. MFA adds an extra layer of security by requiring two or more different authentication factors. They can be used together.
It refers to a physical object you possess, such as a smartphone that receives a one-time code, a USB security key, or a smart card. It is a second factor type used in MFA.
No. Biometrics are always used for authentication — they prove your identity. After authentication, separate rules (like RBAC) determine what you are authorised to do.
It is the security principle that users and systems should only be given the minimum permissions necessary to perform their tasks. This limits the damage if an account is compromised.
You've finished Authentication and Authorization Methods. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?