Authentication and Authorization: What's the Difference?
A company implements a security policy where employees must use a smart card to log into their workstations. After logging in, they can only access file shares that correspond to their department. Which two security concepts are demonstrated in this scenario?
Quick Answer
The answer is authentication and authorization. The smart card login verifies the user’s identity, which is the core of authentication—proving who you are. The subsequent restriction to department-specific file shares controls what resources the user can access, which is the essence of authorization—determining what you can do. On the Microsoft SC-900 exam, this distinction is foundational: authentication always comes first (identity verification), followed by authorization (access control). A common trap is confusing the two when a scenario involves both steps, but remember that logging in is always authentication, while permissions on resources are always authorization. A useful memory tip is the phrase “AuthN before AuthZ”—think of the N in AuthN as “Name” (who you are) and the Z in AuthZ as “Zone” (where you can go).
⚠ Common exam trap
Candidates may mistakenly think that smart cards automatically provide non-repudiation. However, non-repudiation requires additional measures like audit trails or digital signatures, which are not mentioned. The scenario only shows authentication and authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication and authorization
The smart card login verifies the user's identity, which is authentication. The subsequent restriction to department-specific file shares controls what resources the user can access, which is authorization. Non-repudiation is not demonstrated because the scenario lacks any mechanism (such as audit logs or digital signatures) that would prevent the user from denying the login action. Therefore, only authentication and authorization are demonstrated, making Option A the sole correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication and authorization
Why this is correct
Correct. Smart card login is authentication; then limiting access to department file shares is authorization.
- ✗
Identification and accounting
Why it's wrong here
Incorrect. Identification is just claiming an identity, not verifying it; accounting tracks usage, not demonstrated here.
- ✗
Authorization and non-repudiation
Why it's wrong here
Incorrect. Authorization is shown, but non-repudiation is not demonstrated because no mechanism (e.g., logs, signatures) prevents denial of the login action.
- ✗
Confidentiality and integrity
Why it's wrong here
Incorrect. Confidentiality (protecting data from unauthorized access) and integrity (ensuring data is not altered) are not directly demonstrated.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user logs into a company portal by entering a username and password. After successful login, the system checks if the user is a member of the 'Sales' group and then grants access to the sales dashboard. Which two security concepts are demonstrated in this process? (Choose all that apply.) (Choose two.)
easy- ✓ A.Authentication
- ✓ B.Authorization
- C.Non-repudiation
- D.Accounting
Why A: Authentication is demonstrated because the user proves their identity by providing a username and password, which the system verifies before allowing access. This is the process of validating credentials, typically against a directory service like Azure AD or an on-premises Active Directory, confirming the user is who they claim to be. Authorization is demonstrated when, after successful authentication, the system checks the user's group membership ('Sales' group) to determine if they are permitted to access the sales dashboard. This is the process of determining what an authenticated user is allowed to do.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.