ISC2 CC Access Controls Concepts Practice Question
A hospital issues each nurse a unique username and a badge that is scanned at a workstation to prove the nurse's identity before any patient records can be opened. Which access control concept does scanning the badge to prove identity represent?
⚠ Common exam trap
A common mix-up: candidates confuse the act of claiming an identity with the act of proving it, which leads candidates to select identification instead of authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication
Authentication is the verification of a claimed identity, and the badge scan validates that the nurse is the person associated with the enrolled credential. Identification only asserts who someone claims to be, while authorization decides what that verified identity may do. Because the scenario emphasizes proving identity before opening records, the scan is the authentication step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication
Why this is correct
Authentication verifies that the claimed identity matches the person presenting the credential. The badge scan supplies a factor that the system validates against the enrolled identity for that nurse, confirming the user is who the username claims. Only after this verification succeeds can the system decide authorization, so the scan is the authentication step in this scenario.
- ✗
Identification
Why it's wrong here
Identification is the act of claiming an identity, such as typing a username or presenting a badge number. The badge scan could be seen as presenting an identifier, but the scenario states the scan proves the nurse's identity, which goes beyond a mere claim. Proving identity requires verification, which is authentication, not identification alone.
- ✗
Authorization
Why it's wrong here
Authorization is the process of determining what a verified identity is permitted to do, such as reading only the patients on the nurse's assigned ward. The badge scan occurs before any permissions are evaluated, so it does not yet establish what the nurse may access. Authorization depends on a prior successful identity proof, which the scan itself supplies.
- ✗
Accounting
Why it's wrong here
Accounting is the logging and review of activity after access occurs, such as recording which patient records a nurse opened and when. The badge scan happens before access is granted, so it is not a record of activity. Accounting depends on authentication completing first, making it the wrong concept for the identity proof itself.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.