Security Fundamentals Practice Question 2: Authn vs Authz
Security Fundamentals · Test 1 · question 2 of 10
An employee signs in to the company intranet with the correct password and one-time code, and the home page loads. When she opens the payroll administration page, she gets "403 Forbidden: you do not have permission to view this resource." Which security process denied her request?
Show answer and explanation
Answer:
Authentication answers "who are you?" and authorization answers "what are you allowed to do?" She has already proven her identity, since sign-in and the home page both succeeded. The denial happened when the system checked whether that identity is approved to access payroll administration. NIST describes authorization as the process of verifying that a requested action or service is approved for a specific entity (A). HTTP 403 means the server knows who you are but refuses the action.
- B. Authentication succeeded. A failed authentication would have stopped her at sign-in (or, in HTTP terms, typically produce a 401). - C. Identification is claiming an identity, such as typing a username. It came before authentication and clearly worked. - D. Accounting (auditing) records what users did. It may log the denied request, but it does not make the allow/deny decision.
Reference: NIST CSRC Glossary: authorization