Authentication vs Authorization: Understanding Access Control
A user successfully authenticates to a system using a smart card. After authentication, the system checks whether the user's device is compliant with security policies before granting access to the network. This additional check is an example of which security concept?
Quick Answer
The answer is authorization. While authentication verifies identity—in this case, confirming the user is who they claim to be via a smart card—authorization is the subsequent process that determines what an authenticated user is allowed to do. Here, the system checks device compliance with security policies before granting network access, which is a classic authorization decision: it evaluates conditions and permissions to allow or deny access to a resource. On the Microsoft SC-900 exam, this distinction is frequently tested to ensure you understand that authentication is about proving identity, while authorization is about enforcing access rights. A common trap is confusing device compliance checks with authentication factors; remember that any policy-based access decision after identity is confirmed falls under authorization. Memory tip: think "AuthN = Who you are, AuthZ = What you're allowed to do."
⚠ Common exam trap
Many exam-takers confuse the initial identity verification (authentication) with the subsequent policy-based access decision (authorization), especially when both steps occur sequentially in a single login flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
Authorization is the correct answer because after the user is authenticated via smart card, the system evaluates whether the user's device meets security compliance policies before granting network access. This decision—allowing or denying access based on conditions—is the core function of authorization, which determines what resources or actions an authenticated identity is permitted to perform.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization
Why this is correct
Checking device compliance is a condition that must be met before access is granted; this is part of the authorization process.
- ✗
Authentication
Why it's wrong here
Authentication was completed when the user provided the smart card credentials; the subsequent check is not about verifying identity.
- ✗
Accounting
Why it's wrong here
Accounting refers to tracking user activities and resource usage, not enforcing access conditions.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation ensures that a user cannot deny an action, typically through digital signatures; it is not about access checks.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?
easy- ✓ A.Authentication and authorization
- B.Confidentiality and integrity
- C.Identification and non-repudiation
- D.Availability and accountability
Why A: The fingerprint scan demonstrates authentication, as the user proves their identity through a biometric factor. The subsequent role-based check of group membership ('Data Analyst') to grant database access demonstrates authorization. Therefore, only Option A (Authentication and authorization) is correct. Option B is incorrect because confidentiality and integrity are not demonstrated in this scenario: the scenario does not address data protection from unauthorized disclosure (confidentiality) or assurance that data is accurate and unmodified (integrity). The authorization check prevents unauthorized access, which is a component of access control but not a direct demonstration of confidentiality; integrity is not shown at all. Option C is incorrect because identification (claiming an identity) is not shown; the fingerprint is used for proof, not claim, and non-repudiation is not established. Option D is incorrect because availability of the database and accountability of user actions are not demonstrated.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.