SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It determines what a user can access after sign-in

  Why this is correct

  Authorization is the phase of access control that maps an authenticated identity to specific permissions, roles, or policy rules, thereby defining what resources, functions, or data that identity may use. It occurs after authentication because the system must first establish who the user is before it can apply any access decisions. Common implementations include role-based access control (RBAC), attribute-based access control (ABAC), and discretionary access control (DAC), all of which determine the scope of a user's post-login activity.

• ✓

  It usually happens after authentication

  Why this is correct

  In the AAA flow, authentication happens first to verify identity, and then authorization checks what that identity is allowed to do. A system cannot make a meaningful access decision until it knows who the user is.

• ✗

  It proves a user is who they claim to be

  Why it's wrong here

  That describes authentication, not authorization. Authentication verifies identity using something the user knows, has, or is, such as a password, token, or biometric factor; authorization comes later and decides what that authenticated identity can access.

• ✗

  It records every packet a device sends

  Why it's wrong here

  Recording every packet a device sends is a function of accounting, logging, or network monitoring, not authorization. Authorization is a decision-making process that grants or denies access based on permissions and policies; it does not capture or store traffic data. While accounting in the AAA framework tracks user actions for auditing or billing purposes, that is a separate step from determining what a user is allowed to do. Confusing packet capture with authorization misidentifies the distinct roles of access control versus activity logging.

• ✗

  It replaces the need for authentication

  Why it's wrong here

  Authorization cannot replace authentication because the system must first establish who the user is before it can apply permissions. Access control rules depend on an authenticated identity, such as a user account or service principal.