Which security element establishes who a user or system is?

### Why this is right Authentication establishes identity. It answers who is attempting to use a system; authorization then determines what that identity is allowed to do. ### The concept Authentication, authorization, and auditing serve different purposes. Confusing them can lead to weak access decisions: a system must identify an entity before applying permissions, and activity records can later support review. ### The other options - **B. Authorization**: Determines permitted actions after an identity has been established. - **C. Auditing**: Records activity so it can be reviewed; it does not establish identity by itself. - **D. Availability**: Means authorized users can access usable systems or information when needed. ### Terms - **Authentication**: The process of establishing an identity. - **Authorization**: The decision about what an authenticated identity may do. - **Auditing**: Recording or examining activity. ### Remember Authentication asks “who are you?”, authorization asks “what may you do?”