SSCP Access Controls Practice Question
Which of the following is the correct order of the access control process?
⚠ Common exam trap
The trap is mixing up the order of authentication and authorization; candidates might think authorization comes before authentication, but you cannot authorize an unauthenticated identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification, authentication, authorization, accountability
The access control process begins with identification, where a subject claims an identity (e.g., username). Next is authentication, verifying that identity (e.g., password). Then authorization determines what resources the authenticated subject can access. Finally, accountability involves logging and auditing actions to hold the subject responsible. This sequence is fundamental in security models.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification, authentication, authorization, accountability
Why this is correct
Access control proceeds by first claiming an identity, then proving it, then granting rights, then logging activity. Accountability depends on the prior identification and authentication steps, so this sequence reflects the actual dependency chain rather than any reordering of the four stages.
- ✗
Identification, authorization, authentication, accountability
Why it's wrong here
Authentication must precede authorization: a subject proves identity, then the system determines permitted actions. Placing authorization first inverts that dependency, so access decisions would be made before identity is verified. Accountability is the final phase, logging actions to the authenticated identity.
- ✗
Authorization, authentication, identification, accountability
Why it's wrong here
Identification must precede authentication, since a subject's claimed identity is what credentials are verified against; authorisation then follows. Reversing the sequence leaves nothing to authenticate or authorise. It is tempting because authorisation is the goal of access control, so listing it first feels logical, and this order would suit describing a workflow where permissions are pre-assigned before a user logs in.
- ✗
Authentication, identification, authorization, accountability
Why it's wrong here
Authentication verifies credentials, but identification—the subject claiming an identity—must occur first, so this swaps the opening two steps. It is tempting because authentication feels like the natural starting point of a login, and this order would describe systems where a token or certificate supplies identity during verification itself.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.