SSCP Access Controls Practice Question
A user claims to be 'jsmith' and provides a password. What is the term for the step where the system verifies that the password matches the one on file for 'jsmith'?
⚠ Common exam trap
SSCP often tests the distinction between identification (claiming an identity) and authentication (proving it), and between authentication and authorization (what you can do), causing candidates to pick the wrong stage in the identity lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication
Authentication is the process of verifying a claimed identity — here, validating that the password provided matches the stored credential for 'jsmith'. Identification is the act of claiming an identity (e.g., entering a username), while authentication proves it. The question explicitly describes verification of the password, which is authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization
Why it's wrong here
Authorization determines what resources an authenticated subject may access, and it happens only after credentials are verified. It is tempting because login and access decisions feel like one event, but checking the password against the stored value for 'jsmith' is authentication, not permission granting.
- ✗
Identification
Why it's wrong here
Identification is only the claim of an identity — here the asserted username 'jsmith' — and involves no secret or comparison. It is tempting because the username is presented in the same step, but verification of the password against the stored value is authentication, which follows identification.
- ✓
Authentication
Why this is correct
Authentication is the process of verifying a claimed identity by checking the supplied credential against the stored one. Here, the system compares the password against the record for 'jsmith', confirming the user is who they claim to be. This directly satisfies the stem's requirement to verify the password matches the one on file.
- ✗
Accountability
Why it's wrong here
Accountability is the after-the-fact linking of actions to an identity through logging and audit trails; it occurs after access, not during credential checking. It is tempting because accountability depends on successful logins, but the verification of the supplied password against the stored value for 'jsmith' is authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.