Quick Answer

The answer is Authorization, which can be based on privilege levels or attribute-value pairs. This is correct because AAA functions are distinct: Authentication verifies who you are, Authorization determines what you are allowed to do, and Accounting tracks what you did for auditing or billing. Authorization specifically controls access rights by checking privilege levels (like Cisco’s 0-15) or attribute-value pairs (AV pairs) from a RADIUS server. On the ENCOR 350-401 exam, this concept often appears in drag-and-drop questions where you must match each AAA function to its definition, and a common trap is confusing Authorization with Authentication—remember that Authentication asks “Who are you?” while Authorization asks “What can you do?”. For a quick memory tip, think of the acronym “AAA” as a three-step security checkpoint: first you show your ID (Authentication), then the guard checks your clearance level (Authorization), and finally a log records your entry (Accounting).