An employee signs in to the corporate domain with valid credentials and completes MFA, then receives an access-denied message when opening the payroll file share. Which function of AAA produced the denial?
Select an answer to reveal the explanation.
Short Explanation
Your badge gets you into the building, but it won't open the CFO's office. Getting in proved who you are; the locked office is about what you're allowed to touch. The trap is blaming authentication when the login itself already worked fine.
Full Explanation
Authentication confirms identity, and in this scenario it succeeded: the user entered valid credentials and passed multifactor authentication, and the domain issued a session. Authorization is the next decision, comparing that verified identity and its group memberships against the access control list or policy on the resource. The payroll share does not grant the employee's identity read access, so authorization returns a denial. Treating the failure as an authentication problem misreads the sequence; a failed authentication would block sign-in entirely or prompt for credentials again rather than returning access denied on one share after login. Accounting records activity such as logons and resource requests for later review, but it does not make access decisions or block requests on its own. A periodic access review is an oversight activity that may change permissions afterward; it is not consulted live when a user opens a folder. Exam caveat: authentication answers who you are, authorization answers what you may do, and accounting answers what you did; stems that mention a successful login followed by a denial point to authorization. Operational check: inspect the effective permissions for the user on the payroll share, confirm which groups grant access, and if the denial is incorrect, request the change through the data owner rather than adding the user directly.