Which statement defines Authorization?

• A. Verifying the identity of a user or system.
• B. Preventing a sender from denying an action.
• C. Ensuring data is not altered without authorization.
• D. Granting permissions after authentication.

Answer: (D)

Authorization decides what an authenticated user is allowed to do. After identity is verified, the system applies access rules—permissions, roles, and policies—to grant or deny specific actions or resource access. This is why describing authorization as granting permissions after authentication best defines it: authentication answers “who are you?” while authorization answers “what are you allowed to do?” For example, a user might be allowed to view a file but not modify it, or an admin might manage user accounts. The other statements describe authentication (verifying identity), non-repudiation (preventing denial of actions), or data integrity protections, which are separate concepts.