Authentication vs Authorization: Key Identity Concepts
A hotel uses a key card system. Guests insert their card into the door lock, which reads the card's ID number. The system checks the ID number against a list of authorized rooms. If the ID matches an authorized room, the door unlocks. In this scenario, which concept is demonstrated when the system checks the ID number against the list of authorized rooms?
Quick Answer
The answer is authorization. The system checks the ID number against a list of authorized rooms to determine whether the guest is permitted to unlock the door, which is the core function of authorization: granting or denying access rights based on a verified identity. Authentication—proving who you are—happened earlier when the card was issued or when the system read the ID; the subsequent check against the list is purely about permissions, not identity verification. On the Microsoft SC-900 exam, this distinction is frequently tested with real-world scenarios like key cards or login portals, and a common trap is confusing the initial identity check (authentication) with the permission check (authorization). Remember the mnemonic: “AuthN is who you are, AuthZ is what you can do.”
⚠ Common exam trap
It's easy for candidates to confuse 'checking the ID' with authentication, but the scenario explicitly states the ID is already read and the check is against a list of authorized rooms, which is a permission check, not a proof-of-identity check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
The system checks the ID number against a list of authorized rooms to determine what action (unlocking the door) the guest is allowed to perform. This is the definition of authorization: granting or denying access rights based on verified identity. Authentication (proving who you are) has already occurred when the card was issued or when the system reads the ID; the check against the list is purely about permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identification
Why it's wrong here
Identification is the process of claiming an identity (e.g., presenting the card ID), not the subsequent check of permissions.
When this WOULD be correct
A question asks: 'A user enters their username on a login screen. Which concept does this represent?' In that scenario, the user is claiming an identity, so identification would be the correct answer.
- ✗
Authentication
Why it's wrong here
Authentication verifies that the identity claim is genuine, often through a password or biometric. Here, the system is not verifying the card's authenticity; it is checking the ID against a permission list.
When this WOULD be correct
Authentication would be correct if the question described the door lock verifying the guest's identity, such as by checking a PIN code against a stored credential or using a fingerprint scanner to confirm the guest is who they claim to be.
- ✓
Authorization
Why this is correct
Authorization is the process of verifying that an authenticated identity is allowed to perform a specific action or access a resource. The system checking the card ID against a list of authorized rooms is a classic example of authorization.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation ensures that a party cannot deny an action, often using digital signatures. It is not demonstrated in this simple key card scenario.
When this WOULD be correct
A question where a user sends a digitally signed email and later claims they did not send it. The system uses the digital signature to prove the email was indeed sent by that user, demonstrating non-repudiation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuthorizationCorrect answer▾
Why this is correct
Authorization is the process of verifying that an authenticated identity is allowed to perform a specific action or access a resource. The system checking the card ID against a list of authorized rooms is a classic example of authorization.
✗IdentificationWrong answer — click to see why▾
Why this is wrong here
Identification is the process of claiming an identity (e.g., presenting a username or ID number), but the system is not just reading the ID; it is checking whether that ID is permitted to access a specific resource. The act of verifying permissions is authorization, not identification.
★ When this WOULD be the correct answer
A question asks: 'A user enters their username on a login screen. Which concept does this represent?' In that scenario, the user is claiming an identity, so identification would be the correct answer.
Why candidates choose this
Candidates may confuse the reading of the ID number (which is identification) with the subsequent check against the authorized list, mistakenly thinking the entire process is identification rather than recognizing the permission-checking step as authorization.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
The system is checking if the guest's ID is allowed to access a specific room, which is authorization (granting access rights). Authentication would be verifying the guest's identity (e.g., checking a PIN or biometric), not checking against a list of authorized rooms.
★ When this WOULD be the correct answer
Authentication would be correct if the question described the door lock verifying the guest's identity, such as by checking a PIN code against a stored credential or using a fingerprint scanner to confirm the guest is who they claim to be.
Why candidates choose this
Candidates often confuse authentication with authorization because both involve identity checks. The key card ID is used for identification, and the subsequent check against the room list is authorization, but the step of 'checking the ID number' sounds like verifying identity, leading to the wrong choice.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that an action cannot be denied later, typically through digital signatures or logs. In this scenario, the system is simply checking if the ID is allowed to open the door, not preventing denial of the action.
★ When this WOULD be the correct answer
A question where a user sends a digitally signed email and later claims they did not send it. The system uses the digital signature to prove the email was indeed sent by that user, demonstrating non-repudiation.
Why candidates choose this
Candidates may confuse authorization with non-repudiation because both involve verifying permissions or actions, but non-repudiation focuses on irrefutable proof of an action, not access rights.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?
hard- A.Identification and authorization
- ✓ B.Authentication and authorization
- C.Authentication and accounting
- D.Identification and authentication
Why B: The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.