SSCP Access Controls Practice Question
Which term describes the process of verifying the identity of a user, system, or entity?
⚠ Common exam trap
SSCP often tests the distinction between identification, authentication, authorization, and accountability — candidates frequently confuse authentication (verifying identity) with authorization (granting permissions) or identification (claiming identity).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication
Authentication is the process of verifying a claimed identity — typically by validating credentials such as passwords, biometrics, or tokens against stored data. It answers the question 'Are you who you say you are?' Identification is the prior step of claiming an identity, and authorization determines what that identity can do.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization
Why it's wrong here
Authorization grants or denies access rights after identity is established; it does not verify who the entity claims to be. It is tempting because authorization always follows authentication in access-control workflows, but the stem asks specifically about confirming identity, which is authentication's role.
- ✓
Authentication
Why this is correct
Authentication establishes and verifies a claimed identity by validating credentials such as passwords, certificates or biometrics, directly satisfying the stem's requirement to verify a user, system or entity. It is distinct from authorisation, which grants access rights after identity is confirmed, and from identification, which merely presents an identity claim.
- ✗
Identification
Why it's wrong here
Identification is the claim of an identity, such as a username, without proof; verification of that claim is authentication. It is tempting because the two terms are often paired, yet identification alone cannot confirm the entity is genuine, which is what the stem demands.
- ✗
Accountability
Why it's wrong here
Accountability ties actions to an identified subject through logging and auditing, occurring after identity is verified. It is tempting because accountability depends on prior authentication, but it does not itself confirm the claimed identity, so it fails the definition the stem requires.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.