Which of the following is the process by which a user's privileges are…

Concept:

A security system separates three different questions about a subject that wants to use a protected resource: who the subject is, what rights that subject holds, and whether one particular request may proceed. Verifying a claimed identity against the evidence it presents is authentication; determining the set of rights, permissions or privileges that the established identity holds is authorization; enforcing those decisions on every individual request at the resource is access control.

Application:

The stem asks for the process by which a user’s privileges are ascertained — that is, the step that works out what rights the user holds. This is exactly Authorization. Once an identity has been established, the system consults its security policy — access-control lists, capability lists, role assignments or SQL GRANT/REVOKE entries — and derives the set of operations that this subject may perform. In the classical AAA model (Authentication, Authorization, Accounting) the second A is defined in precisely these terms.

Cross-check — how the other named terms differ:

• Authentication answers “who are you?”. It tests a claimed identity against a password, one-time code, certificate or biometric and yields an established identity; it never states which operations that identity may perform.

• Access control is the wider enforcement mechanism — the reference monitor that intercepts each request and permits or denies it. It consumes the privilege set that authorization has already worked out, and its models (DAC, MAC, RBAC) describe how the policy is applied rather than how the privileges are ascertained.

• None of these does not apply, since Authorization is present among the listed terms and names this process exactly.

Hence the process by which a user’s privileges are ascertained is Authorization.