What statement best describes the difference between authentication and authorization?

Authentication: Verifying "who" the user or device is (e.g., via passwords, certificates).

Authorization: Controlling "what" a user or device can do once authenticated (e.g., read-only vs. read/write permissions).

Combined for Security: Both are essential. Authentication alone doesn't control access levels, and authorization without verification is meaningless.

References:

Identity and Access Management (IAM): Articles and resources outlining the core principles of authentication and authorization.

Cybersecurity Best Practices: Guides on securing systems will often emphasize the need for both authentication and authorization controls.