SSCP Access Controls Practice Question
A retail chain issues each cashier a badge containing a photograph and a scannable code. At the start of every shift, a supervisor visually compares the badge photograph to the person and scans the code into the point-of-sale terminal. Which two access control components are being combined in this process?
⚠ Common exam trap
The trap here is treating any credential presented at a checkpoint as authentication, when a bare identifier such as a badge number only claims an identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification by the badge code and authentication by the supervisor's visual comparison
The badge code is an assertion of who the cashier claims to be, and the supervisor's check that the face matches the photograph validates that assertion. Identification precedes authentication, and both precede the authorization decision the terminal makes about which functions the cashier may use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization by the badge code and accounting by the supervisor's visual comparison
Why it's wrong here
A badge code carries no privileges, so it cannot authorize anything. Accounting records what a subject did after access was granted, typically through logs or audit trails, and a supervisor glancing at a photograph produces no such record. Neither term describes the roles these two steps actually play in the shift-start process.
- ✓
Identification by the badge code and authentication by the supervisor's visual comparison
Why this is correct
Presenting the badge code claims an identity, which is identification. The supervisor confirming that the person matches the photograph verifies that claim, which is authentication. Together they establish who the cashier is before the terminal grants any access, matching the two components the process combines.
- ✗
Identification by the supervisor's visual comparison and authentication by the badge code
Why it's wrong here
The order is reversed here. The badge code is the claim of identity presented to the system, so it serves identification. The human comparison of face to photograph validates that claim and therefore serves authentication. Swapping them mischaracterizes both steps and would imply the code proves identity on its own, which it does not.
- ✗
Authentication by the badge code and authorization by the supervisor's visual comparison
Why it's wrong here
The scannable code alone asserts an identity but proves nothing, so it is not authentication. The visual comparison confirms the claim rather than deciding what the cashier may do, so it is not authorization. Authorization would be the terminal determining which registers and functions the cashier may use after identity is established.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.