A payroll system verifies a user's identity before checking which records that user may view. Which sequence describes these steps?

### Why this is right The system first needs to establish who is making the request. It can then use that identity to decide which records the user is permitted to access. ### The concept **Authentication** is the process of checking an identity, such as confirming a user's login credentials. **Authorization** is the subsequent decision about what that identity may do or view. These steps support **confidentiality**, the protection of information from unauthorized access or disclosure. Authentication by itself does not grant permission to every resource. For example, a payroll employee may be authenticated successfully but still lack authorization to view an executive's compensation record. ### The other options - **A. Authorization followed by authentication**: Reverses the normal sequence. A system generally needs an established identity before applying identity-specific permissions. - **C. Integrity followed by availability**: These are security goals, not the identity-checking steps in the scenario. - **D. Encryption followed by redundancy**: These are controls that can support confidentiality or availability, not the sequence used to identify and permit a user. ### Terms - **Authentication**: Checking that a user or system is who it claims to be. - **Authorization**: Deciding what an authenticated user or system is allowed to access or do. - **Confidentiality**: Protecting information from access or disclosure to unauthorized parties. ### Remember Establish identity first, then decide what that identity is allowed to do.