SY0-701 General Security Concepts Practice Question
Which two statements describe authorization? Select two.
⚠ Common exam trap
Many candidates confuse authorization with authentication, as many candidates mistakenly think proving identity (authentication) also grants access rights, but authorization is a distinct step that occurs after authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It determines what a user can access after sign-in
Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It determines what a user can access after sign-in
Why this is correct
Authorization is the phase of access control that maps an authenticated identity to specific permissions, roles, or policy rules, thereby defining what resources, functions, or data that identity may use. It occurs after authentication because the system must first establish who the user is before it can apply any access decisions. Common implementations include role-based access control (RBAC), attribute-based access control (ABAC), and discretionary access control (DAC), all of which determine the scope of a user's post-login activity.
- ✓
It usually happens after authentication
Why this is correct
In the AAA flow, authentication happens first to verify identity, and then authorization checks what that identity is allowed to do. A system cannot make a meaningful access decision until it knows who the user is.
- ✗
It proves a user is who they claim to be
Why it's wrong here
That describes authentication, not authorization. Authentication verifies identity using something the user knows, has, or is, such as a password, token, or biometric factor; authorization comes later and decides what that authenticated identity can access.
- ✗
It records every packet a device sends
Why it's wrong here
Recording every packet a device sends is a function of accounting, logging, or network monitoring, not authorization. Authorization is a decision-making process that grants or denies access based on permissions and policies; it does not capture or store traffic data. While accounting in the AAA framework tracks user actions for auditing or billing purposes, that is a separate step from determining what a user is allowed to do. Confusing packet capture with authorization misidentifies the distinct roles of access control versus activity logging.
- ✗
It replaces the need for authentication
Why it's wrong here
Authorization cannot replace authentication because the system must first establish who the user is before it can apply permissions. Access control rules depend on an authenticated identity, such as a user account or service principal.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Authentication Methods
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.