Examkin

Question

Difficulty: EasyIdentity and Access Management Operations

A security technician is investigating an access issue where a newly transferred employee successfully signs into the corporate network using valid credentials, but is subsequently able to view restricted financial files reserved for executive roles. The technician incorrectly believed that validating the employee's login identity automatically granted permission to access all files on the file server. Which of the following operational concepts did the technician confuse?

  1. Authentication vs. authorizationAnswer
  2. B
    Perimeter network trust vs. microsegmentation
  3. C
    Preventive security controls vs. detective security controls
  4. D
    Credential harvesting detection vs. impossible travel alerts

Answer

Authentication vs. authorization
Authentication is the operational process of proving an identity (e.g., supplying a valid username, password, or MFA token). Authorization is the process of evaluating access control lists or policies to determine what actions or data that authenticated identity is allowed to access. Assuming that successful identity verification grants access to confidential files confuses authentication with authorization.

Step-by-Step Solution

1
Analyze the access incident described in the scenario.
The employee successfully verified their login identity, but was granted access to file resources beyond their scope of work.
Understanding the distinction between login verification and permission assignment is necessary to identify the administrative error.
2
Define the roles of authentication and authorization within Identity and Access Management operations.
Authentication confirms identity (who the user is), while authorization enforces permissions (what resources the user can access).
Valid login credentials prove identity during authentication, but authorization access rules dictate resource entitlements.
3
Match the technician's assumption to the correct concept pair.
The technician assumed identity verification automatically implies full resource permissions, confusing authentication with authorization.
Believing a valid login grants blanket file system access demonstrates a failure to differentiate authentication from authorization.

Key Concept

Distinction between Authentication and Authorization in IAM Operations
Estimated Time:45s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic