Which statement correctly distinguishes authentication from authorization?

Which statement correctly distinguishes authentication from authorization?

• A. Authentication proves what a user can do.
• B. Authorization verifies who is making a request.
• C. Authentication verifies who is making a request.
• D. Authorization and authentication are the same

Answer: (C)

The main idea here is the difference between proving identity and proving permissions. Authentication is about confirming who the user is—verifying the person making the request. Authorization, on the other hand, is about confirming what that authenticated user is allowed to do or access. So the correct statement is that authentication verifies who is making a request. The other ideas mix up the roles: proving what a user can do describes authorization, not authentication; verifying who is making a request is what authentication does, not authorization; and saying they are the same ignores that identity verification and permission checks are two distinct steps in controlling access.

The main idea here is the difference between proving identity and proving permissions. Authentication is about confirming who the user is—verifying the person making the request. Authorization, on the other hand, is about confirming what that authenticated user is allowed to do or access.

So the correct statement is that authentication verifies who is making a request. The other ideas mix up the roles: proving what a user can do describes authorization, not authentication; verifying who is making a request is what authentication does, not authorization; and saying they are the same ignores that identity verification and permission checks are two distinct steps in controlling access.