SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Authentication, because the user proved their identity with credentials.

  Why it's wrong here

  Authentication is the initial step of proving identity via credentials like a password or smart card, but the scenario specifically occurs after the employee has already signed in. At that point, the portal has established the user's identity, so the subsequent check of whether they may upload files to a particular folder is a permission decision, not another identity verification. Thus, while authentication is necessary, it is not the process being described in the post-sign-in access control.

• ✓

  Authorization, because the system is deciding what the signed-in user is allowed to do.

  Why this is correct

  Authorization is the process of determining permissions after identity has been confirmed. In this case, the portal is checking whether the authenticated user may upload files to a particular folder. That is a classic authorization decision because it controls access to a resource based on assigned rights, roles, or group membership.

• ✗

  Accounting, because the portal is recording the folder permissions for later review.

  Why it's wrong here

  Accounting (auditing) involves recording user activities after the fact for review—such as logging which user uploaded a file, the timestamp, and the folder accessed—to enable security monitoring and compliance. The scenario, however, describes the system actively deciding whether to allow or deny the upload based on the user's assigned rights or group membership. Permission enforcement is a real-time authorization decision, not the passive logging of events that accounting entails.

• ✗

  Nonrepudiation, because the portal proves the user cannot deny uploading a file.

  Why it's wrong here

  Nonrepudiation ensures that a user cannot deny having performed an action, typically through cryptographic mechanisms like digital signatures or robust audit logs that bind an actor to a specific event. It does not, by itself, determine whether the user has the right to upload a file; that access-control decision is made during authorization. In this case, the portal's permission check is a precondition to the action, not a proof of the action's occurrence, so nonrepudiation is irrelevant to the described process.

Go deeper

Related to this question