Which statement best differentiates authentication from authorization?

• A. Authentication determines access to resources; authorization verifies identity.
• B. Authentication is about encryption; authorization is about auditing.
• C. Authentication verifies identity; authorization determines what resources and actions an authenticated user may access.
• D. Authentication logs events; authorization creates user accounts.

Answer: (C)

Authentication is proving who you are, while authorization decides what you are allowed to do once your identity is known. In practice, you present credentials (like a password, token, or biometric), and the system verifies that identity. After that, the system checks your permissions—your roles or access rights—to determine which resources you may access and which actions you may perform.

That separation is why the statement describing authentication as verifying identity and authorization as determining access to resources and actions for an authenticated user is the best fit. The other options mix up these ideas or bring in unrelated concepts: encryption and auditing aren’t the core functions of authentication/authorization, and logging events or creating accounts aren’t the defining roles of these two processes.