What is the process of enforcing policies after the user has been authenticated?

• A. Authorization
• B. Authentication
• C. Secure passwords
• D. Spear fishing

Answer: (A)

Enforcing what a user is allowed to do after their identity has been verified is authorization. After authentication confirms who the user is, the system applies access control policies to decide which resources and actions are permitted for that user. This separation ensures security by not only verifying identity but also enforcing permissions based on roles, attributes, or other rules. For example, once you log in, you can access only your own files and certain shared resources; an administrator would have broader access as defined by permissions. The mechanism behind this includes access control lists, role-based access control, and attribute-based access control. Authentication focuses on proving identity, whereas authorization handles policy enforcement; secure passwords contribute to authentication strength, while spear phishing is an attack that seeks to steal credentials, not a mechanism to enforce policies after authentication.