A user successfully signs in with their credentials, then is denied access to a resource because their role doesn't permit it. Which two concepts do the two steps represent?
A.Authorization, then authentication
The order is reversed — you authenticate before authorization can be evaluated.
B.Authentication, then authorization
AuthN = identity proof (sign-in); AuthZ = permission check (denied by role). Correct.
C.Encryption, then hashing
Encryption/hashing are data-protection primitives, not access-control steps.
D.Federation, then conditional access
Federation and conditional access are specific identity mechanisms, not the two generic steps.
Why this answer
Authentication (AuthN) proves who you are — the sign-in. Authorization (AuthZ) determines what you're allowed to do — the role/permission check. Sign-in first, permission check second.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Access practice session.
Practice Identity & Access